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(54) CONTENTS PROVIDING SYSTEM 



(57) After a reproduction program is installed on a 
PC, a key for CD ripping is furnished e.g., from an FD. 
With the key for CD ripping, the music contents in a CD 
can be copied to a PC, however, it is not possible to 
download music contents from an EMD server for cop- 



ying on a PD. For storing the music contents distributed 
from the EMD server on the PD. the reproduction pro- 
gram first acquired a key for EMD different from the key 
for ripping over the network By so doing, the contents 
data distributed over the network may be improved in 
safety. 




FIG.29 
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Description 

Technical Field 

s [0001] This invention relates to a system and a method for furnishing contents data to a portable reproducing appa- 
ratus employing e.g., a semiconductor memory or a memory card as a recording medium. 

Background Art 

10 [0002] Recently, on-line distribution of music contents employing a network, such as Internet or cable television, has 
come to be put to practical application. 

[O003] In this distribution system for music contents, the contents distributors distributing the musical contents over 
the network furnish music contents over e.g., the Web. The user exploiting this music distribution system uses his or 
her own personal computer to access the Web furnished by the contents distributor to download the desired music 
is contents. The user reproduces the so-acquired music contents by e.g., s player application provided within the personal 
computer or by e.g., a portable device connectable to the personal computer. 

[0004] Meanwhile, the contents purveyor must supervise the copyright of the contents. So, the contents distributor 
recognizes the users, who have accessed the Web over the Internet, by the ID information or the secret identification 
code, to distribute the encrypted music contents only .o an authorized user. The music contents are stored in a hard 
20 disc in the personal computer in a state in which they are key-managed by a secret key that cannot be freely referenced 
by a user. I n transferring the music contents stored in the personal computer to a portable device, authorization process- 
ing is executed between a player application and a portable device before the music contents are stored on a recording 
medium owned by the portable device. 

[0005] Meanwhile, in general, not only the music contents distributed from the network but also those from a recording 

2s medium, such as a CD, can be copied on the portable device. 

[0006] However, in the conventional authentication system between the portable device and the personal computer, 
no distinction has been made between the player application handling only music contents copied from a recording 
medium, such as CD, and the player application handling music contents downloaded from the network. 
[0007] So, if the authentication key between the portable device and the personal computer is broken by a person 

30 with a malignant intention, both the music contents copied from a recording medium, such as CD, and the music 
contents distributed over the network, are copied illicitly. 

[0008] In the case of the recording medium, such as CD, in particular, charging is finished in a majority of cases at 
the time it is sold. However, the music contents distributed over the network are charged from time to time depending 
on the number of reproduction or duplication, so that more strong key management is desirable. 

35 

Disclosure of the Invention 

[0009] It is therefore an object of the present invention to provide a system and a method for furnishing contents 
whereby it is possible to improve the safety of contents data distributed over the network. 

-*o [0010] A contents purveying system according to the present invention includes a data processor having a repro- 
duction program for reproducing contents data, a portable reproducing device for storing the contents data furnished 
from the data processor on a recording medium for reproduction and a contents server for distributing the contents 
data over a network to the data processor. The data processor is configured so that a first master key and a first 
authentication key are furnished to the reproduction program after installing the reproduction program, the contents 

->s . data stored in an external storage medium connected to the data processor are acquired using the first master key for 
storage, and so that the reproduction program executes authentication the potable reproducing device using the so- 
furnished first authentication key and first master key. When transmission/reception of the contents data distributed 
from the contents server to the reproduction program is made with the portable reproducing device, a second master 
key different from the first master key and a second authentication key different from the first authentication key are 

so furnished over the network, the contents data furnished from the contents server are acquired using the so-furnished 
second master key for storage, and authentication with the portable reproducing device is performed using the so- 
furnished second authentication key and the second master key to effect transmission/reception of the contents data. 
[001 1 ] If , in the contents purveying system, the reproduction program handles only contents data stored in an external 
storage medium, the system stores the contents data stored in the external storage medium and executes reciprocal 

55 authentication with the portable reproducing device using the first authentication key and the first master key. If the 
reproduction program handles contents data purveyed over a network, the system handles contents data purveyed 
over the network, the system stores the contents data stored in the external storage medium and executes reciprocal 
authentication with the portable reproducing device using the first authentication key and the first master key. The 
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second authentication key and the second master key are purveyed over the network to the reproduction program and 
arc keys different from the first authentication key and the first master key, respectively. 

[0012] A contents purveying method according to the present invention furnishes contents data to a user by a data 
processor having a reproduction program for reproducing contents data, a portable reproducing device for storing the 
contents data furnished from the data processor on a recording medium for reproduction and a contents server for 
distributing the contents data over a network to the data processor. A first master key and a first authentication key 
are furnished to the reproduction program after installing the reproduction program, and the contents data stored in 
an external storage medium connected to the data processor are acquired using the first master key for storage. The 
reproduction program executes authentication with the potable reproducing device using the so-furnished first authen- 
tication key and first master key. When transmission/reception of the contents data distributed from the contents server 
to the reproduction program is made with the portable reproducing device, a second master key different from the first 
master key and a second authentication key different from the first authentication key are furnished over the network, 
and the contents data furnished from the contents server are acquired using the so-furnished second master key for 
storage. The authentication with the portable reproducing device is performed using the so-furnished second authen- 
tication key and the second master key to effect transmission/reception of the contents data. 

[0013] If, in the contents purveying system, the reproduction program handles only contents data stored in an external 
storage medium, the system stores the contents data stored in the external storage medium and executes reciprocal 
authentication with the portable reproducing device using the first authentication key and the first master key. If the 
reproduction program handles contents data purveyed over a network, the system handles contents data purveyed 
over the network, the system stores the contents data stored in the external storage medium and executes reciprocal 
authentication with the portable reproducing device using the first authentication key and the first master key. The 
second authentication key and the second master key are purveyed over the network to the reproduction program and 
are keys different from the first authentication key and the first master key, respectively. 

Brief Description of the Drawings 

[0014] 

Fig . 1 shows a system structure of a music contents distributing system embodying the present invention. 
Fig. 2 explains the configuration of a personal computer used in the content data management system. 
Fig. 3 explains the configuration of a portable device included in the content data management system. 
Fig.4 explains functions of the personal computer. 
Fig. 5 shows an example of display/operation-instructive window. 

Fig. 6 shows an example of the window which the recording program makes the display unit display. 

Fig. 7 explains unified handling of contents having different formats from one distributor to another in the music 

contents distributing system. 

Fig. 8 illustrates the relation between a unified transfer protocol layer and an application layer. 
Fig. 9 illustrates the format of the routinely used using condition information. 

Fig. 1 0 illustrates a file constituting the unified using condition information employed in a comprehensive manage- 
ment unit. 

Fig. 11 illustrates the structure of an automaton file of the unified using condition information. 
Fig. 1 2 shows an example of an automaton indicating the operation transition of music contents stated in the au- 
tomaton stating portion of the automaton file. 
Fig. 13 represents the automaton in a tuple string. 
Fig. 1 4 illustrates the structure of the automaton stating portion. 

Fig. 15 shows an event and a command defined in a DTD determined based on the specification of an XML. 

Fig. 1 6 shows a first statement example of the automaton slating portion. 

Fig 1 7 is a state transition view of the first statement example. 

Fig. 18 shows a second statement example of the automaton stating portion. 

Fig. 19 is a state transition view of the second statement example. 

Fig. 20 shows a third statement example of the automaton stating portion. 

Fig 21 is a state transition view of the third statement example. 

Fig. 22 shows a fourth statement example of the automaton stating portion. 

Fig. 23 shows the structure of a parameter file of the unified using condition information. 

Fig. 24 illustrates the structure in case the parameter file has been changed. 

Fig 25 illustrates the structure of a parameter statement portion of the parameter file. 

Fig. 26 illustrates a method for supervising the contents by the comprehensive management unit. 

Fig.27 illustrates the processing sequence in case the comprehensive management unit is installed from a CD- 
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ROM. 

Fig.28 illustrates the processing sequence in case the comprehensive management unit is installed on being down- 
loaded from the network. 

Fig.29 illustrates an updating sequence Irom a ripping key to an EMD key. 
5 Fig.30 illustrates a first example of the EMD key updating sequence. 

Fig.31 illustrates a second example of the EMD key updating sequence. 

Best mode for Carrying out the Invention 

10 [0015] Referring to the drawings, a music contents distributing system, embodying the present invention, represent- 
ing the best mode of execution of the present invention is explained in detail. This music contents distribution system 
is such a system which downloads the music contents lorn a server to a personal computer or to a portable device 
over a network and which supervises the so-downloaded music contents and music contents read out from a CD. 

'5 (1) Overall Structure of Music Contents Distributing; System 

[0016] Fig 1 shows a system configuration of a music contents distributing system 1 embodying the present invention. 
[0017] The music contents distributing system 1 . embodying the present invention, includes a personal computer 1 , 
a network 2, such as local area network, a registration seivci 3. a plurality o( EMD (electrical music distribution) servers 
20 4 (4-1 , 4-2 and 4-3) distributing music contents, lefened to below as contents, and WWW servers 5 (5-1 and 5-2). The 
personal computer 1 has stored therein a storage medium, such as a memory card, over USB cables 7 (7-1 , 7-2 and 
7-3), and is connected to portable devices 6 (6-1 . 6-2. 6-3) as a portable music reproducing equipment for reproducing 
the contents. 

[0018] The personal computer 1 is connected over a network 2 to the EMD registration server 3, EMD servers 4 

25 (4-1 , 4-2 and 4-3) and to the WWW (World Wide Web) servers 5 (5-1 and 5-2). 

[0019] The personal computer 1 receives contents compressed in accordance with a pre-set compression system, 
and encrypts the compressed contents in accordance with a pre-set encryption system for storage. As the compression 
system, ATRAC (adaptive transform acoustic coding) 3 (trademark) or MP3 (MPEG audio layer-3) may be used. As 
the encryption system, description (data encryption standard), (or example, is used. 

30 [0020] In receiving the distributed contents, the personal computer 1 also receives distributed using condition infor- 
mation, indicating the using conditions for the contents, to record the distributed data. When recording the contents 
read out from e.g., a CD, the personal computer 1 generates the using condition information depending on the contents 
reproducing conditions to record the generated using condition information. 

[0021] Also, the personal computer 1 records and stores the contents, recorded encrypted, in the portable devices 
35 6 (6-1 , 6-2 and 6-3), over th USB cables 7 (7-1 , 7-2 and 7-3), along with the relevant information, such as the using 
condition information, titles of musical numbers or the names of the performers, while updating the using condition 
information responsive to the recording and storage. This processing is called checkout. In this checking-out operation, 
the number of times of possible checking-out operations for the contents, recorded by the personal computer 1, is 
decremented by 1 in the using condition information. If the number ot times of possible checking-out operations is 0, 
J0 the corresponding contents cannot be checked out. 

[0022] Moreover, the personal computer 1 erases the contents stored in the portable devices 6 (6-1 , 6-2 and 6-3), 
through the USB cables 7 (7-1 , 7-2 and 7-3), and updates the using condition information in association with the erasure. 
This erasure operation is called check-in. In this check-in operation, the number of times of the possible checking-out 
operations, recorded by the personal computer 1 , is incremented by 1 . It is noted that the contents may also be made 
45 unusable instead of being erased. 

[0023] It is noted that the personal computer 1 is unable to check-in the contents some other personal computer has 
checked out to the portable device 6. That is, the personal computer 1 is only able to check-in the contents checked 
out by no other than the personal computer 1 . 

[0024] When the personal computer 1 has started acquiring the contents from the EMD servers 4 (4-1 , 4-2 and 4-3), 
so the EMD server 3 is responsive to a request from the personal computer 1 to transmit an authentication key necessary 
for reciprocal authentication between the personal computer 1 and the EMD servers 4 (4-1 , 4-2 and 4-3) to the personal 
computer 1 , over the network 2, while transmitting the program for connection to the EMD servers 4 (4-1 , 4-2 and 4-3) 
to the personal computer 1 . 

[0025] The EMD servers 4 (4-1 , 4-2 and 4-3) are each responsive to a request of the personal computer 1 to furnish 
55 contents to the personal computer 1 , over the network 2, along with the using condition information and data relevant 
to the contents, such as the titles of the music numbers or the performers. 

[0026] The contents distributed by the respective EMD servers 4 (4-1 , 4-2 and 4-3) have been compressed in ac- 
cordance with a pre-set encryption system which may differ from one server to another. On the other hand, the contents 
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furnished by the EMD servers 4 (4-1 , 4-2 and 4-3) are distributed encrypted in accordance with a pre-set encryption 
system which may also differ from one server to another. 

[0027] The WWW servers 5 (5-1 , 5-2) are each responsive to the request from the persona] computer 1 to furnish 
to the personal computer 1 data corresponding to a CD which has read the contents, such as album name of the CD 
5 or the CD selling company) and data corresponding to the contents read out from the CD, such as the name of the 
musical number or the composer's name, to the personal computer 1 . 

[0028] The portable devices 6 (6-1 , 6-2 and 6-3) reproduce the contents furnished from the personal computer 1 , 
that is the content as checked out, to output the reproduced contents to e.g., a headphone, not shown. 
[0029] Each of the portable devices 6 (6-1 , 6-2 and 6-3) has a recording medium for storage of the contents. As the 
10 recording medium, a unremovable IC memory, loaded on an internal substrate of an apparatus, or a removable memory 
card, is used. The portable devices 6 (6-1, 6-2 and 6-3) are connected to the personal computer 1 over physical 
interfaces 7 (7-1 , 7-2 and 7-3), such as USB, for transferring the contents. The contents, to which is also appended 
the using condition information, are transferred in the encrypted and compressed form. 

[0030] The portable devices 6 (6-1 , 6-2 and 6-3) are usually employed in such a state that the respective devices 6 
'5 are disconnected from the personal computer 1 , If a replay command is issued from the user in this state, the encrypted 
contents are read out from the recording medium and reproduced. Moreover, the portable devices 6 (6-1 , 6-2 and 6-3) 
manage control for limiting the reproduction, based on the using condition information appended to the respective 
contents, or as necessary, deleting the contents, or updating the using condition information. 

[0031] In the following, if it is unnecessary lo distinguish the portable devices 6 (6-1 , 6-2 and 6-3) from one another, 
20 they are simply referred to as portable devices 6. 

[0032] FIG. 2 is an explanatory illustration of the configuration of the personal computer 1 . 

[0033] As shown, the personal computer 1 comprises a CPU (central processing unit) 11. The CPU 11 actually 
executes a variety of applications (will further be described later) and OS (operating system). A ROM (read-only mem- 
ory) 12 is also provided in the personal computer 1 , and generally stores basically fixed data of programs and compu- 
25 tational parameters used in the CPU 11 . Also, a RAM (random-access memory) 13 is included in the personal computer 

I to store programs used for execution of the applications and OS by the CPU 1 1 and parameters which are appropri- 
ately variable in the execution of the applications and OS. The CPU 11 , ROM 12 and RAM 13 are mutually connected 
to each other by a host bus 14 composed of a CPU bus, etc. 

[0034] The host bus 14 is connected to an external bus 1 6 such as PCI (peripheral component interconnect/interface) 
30 by a bridge 15. 

[0035] A keyboard 1 8 is operated by the user to input various commands to the CPU 1 1 . A mouse 1 9 which is used 
by the user to point and select a point on the screen of a display unit 20. The display unit 20 is a liquid crystal display 
or CRT (cathode-ray tube) to display a variety of information in the form of a text and/or image. Further, an HDD (hard 
disc drive) 21 drives a hard disc to write or read a program to be executed by the CPU 11 and information to orfrom 
35 the hard disc. 

[0036] The drive 22 reads data or program recorded in any of a magnetic disc 41 , optical disc 42 (including CD), 
magneto-optical disc 43 and semiconductor memory 44, whichever is connected to the drive 22, and supplies the read 
data or program to the RAM 13 connected thereto by an interface 17, external bus 16, bridge 15 and host bus 14. 
[0037] The USB port 23 (23-1 , 23-2, 23-3) has the portable device 6 (6-1 , 6-2, 6-3) connected thereto by the USB 
■to cable 7 (7-1 , 7-2, 7-3), and outputs data (including a content or a command to the portable device 6, for example) 
supplied from the HDD 21, CPU 11 or RAM 13 to the portable device 6 (6-1, 6-2, 6-3) via the interface 17, external 
bus 16, bridge 1 5 or host bus 14. 

[0038] An audio input/output interface 24 having an IEC (International Electrotechnical Commission) 60958 terminal 
24 interfaces a digital audio input/output or an analog audio input/output. A speaker 45 provides a predetermined sound 
corresponding to each content based on an audio signal supplied from the audio input/output interface 24. 
[0039] The accessories including the keyboard 18, the mouse 19, the display 20, the HDD 21, drive 22, the USB 
port 23 and the audio input/output interface 24 are connected to the interface 17 which in turn is connected to th CPU 

II by the external bus 16, bridge 15 and host bus 14. 

[0040] A communications block 25 connected to the network 2, and transmit, as stored in packets in a predetermined 
so manner, data (e.g., request for registration or request for sending a content) supplied from the CPU 11 or HDD 21 via 
the network 2 while outputting data (e.g., authenticate key or content) stored in received packets to the CPU 11, RAM 
13 or HDD 21 via the network 2. 

[0041] The CPU 32 of an adaptor 26 formed integrally as a semiconductor IC, and connected to the personal computer 
1 is connected to the CPU 11 by the external bus 16, bridge 15 and host bus 14 and thus cooperates with the CPU 11 
55 to effect various processes. The RAM 33 stores data and programs necessary for execution of the various processes 
by the CPU 32. The nonvolatile memory 34 stores data which have to be held still after the personal computer 1 is 
turned off. The ROM 36 stores a program for decryption of an encrypted program transferred from the personal com- 
puter 1 . The RTC (Real Time Clock) 35 keeps time to provide time information. The semiconductor IC is designed to 
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have a secured environment and has tolerance toward fraudulent accesses from outside. This function may be struc- 
tured in a software program. 

[0042] The communications block 25 and adaptor 26 are connected to the CPU 11 by the external bus 1 6, bridge 
15 and host bus 14. 

5 [0043] Referring now to FIG. 3, the portable device 6 is schematically illustrated in the form of a block diagram. 
[0044] A power circuit 52 converts a voltage supplied from a dry cell 51 to an internal power of a predetermined 
voltage. Supplying the power to components from a CPU 53 to display unit 67, the power circuit 52 will thus drive the 
entire portable device 6. 

[0045] When connected to the personal computer 1 by a USB connector 56 and USB cable 7, the USB controller 57 
10 will supply data including a content transferred from the personal computer 1 to the CPU 53 via an internal bus 58. 
[0046] A data to be transferred from the personal computer 1 is composed of data of 64 bytes per packet, and 
transferred from the personal computer 1 at a transfer rate of 12 Mbits/sec. 

[0047] A data to be transferred to the portable device 6 is composed of a header and content. The header stores a 
content ID, file name, header size, content key, file size, codec ID, file information, etc. and also using condition infor- 
'5 mation, etc., necessary for the playback limitation. The content is coded by the encoding method such as ATRAC3 
and encrypted. 

[0048] The header size indicates a data length of a header (e.g., 33 bytes), and the file size indicates a data length 
of the content (e.g., 33,636,138 bytes). 

[0049] The contenl key is a key for decryption of an encrypted content, and transmitted from the personal computer 
20 1 to the portable device 6 in a format encrypted based on a session key (provisional) generated via a mutual authen- 
tication between the personal computer 1 and portable device 6. 

[0050] When the portable device 6 is connected to the USB port 23 of the personal computer 1 by the USB cable 7, 
there will be made a mutual authentication between the portable device 6 and personal computer 1 . This mutual au- 
thentication is of a challenge-response type for example. Note that a DSP (digital signal processor) 59 is also provided 

25 in the portable device 6 to decrypt an encrypted content when the challenge-response type authentication is done. 
[0051] The above-mentioned challenge-response type mutual authentication is such that in response to a certain 
value (challenge) generated by the personal computer, for example, there is generated a value (response) by the 
portable device 6 by using a private key common to both the portable device 6 and personal computer 1 . In the chal- 
lenge-response type mutual authentication, the value generated by the personal computer 1 varies at every authenti- 

30 cation. So, even when for example a value generated using the private key and outputted from the portable device 6 
is read, that is, a so-called disguised attack takes place, the personal computer 1 can detect a fraudulence since a 
next mutual authentication is done using a different value. 
[0052] The content ID is an ID for a content to identify the content. 

[0053] The codec ID is an ID corresponding to an encoding method for a content. For example, a codec ID of "1" 
35 corresponds to ATRAC3 while a codec ID of "0" corresponds to MP3 (MPEG (Moving Picture Experts Group) Audio 
Layer-3). 

[0054] The file name is a data resulted from conversion of a content file (will further be described later) corresponding 
to a content and recorded in the personal computer 1 to an ASCII (American National Standard Code for Information 
Interchange) code The file information is a data resulted from conversion of a music piece title (content name), name 
-to of the artist playing the music piece, name of the songwriter of the music piece or name of the composer of the music 
piece to an ASCII code. 

[0055] When the portable device 6 receives a content and a content write command from the personal computer 1 , 
the CPU 53 which executes a main program read from a RAM 54 or ROM 55, will receive the write command, control 
a flash memory controller 60 and write to a flash memory 61 the content received from the personal computer 1 . 
45 [0056] The flash memory 61 has a storage capacity of about 64 Mbytes to store the content. Also, the flash memory 
has stored therein in advance a playback code for expansion of a content having been compressed in a predetermined 

[0057] Note that the flash memory 61 may be formed as a memory card which is connectable tc, and removable 
from, the portable device 6. 

so [0058] When the CPU 53 is supplied with a playback command corresponding to a push-down operation of a play/ 
stop button (not shown) via an operation key controller 52, it will make the flash memory controller 60 read the playback 
code and content from the flash memory 61 and transfer them to the DSP 59 of the portable device 6. 
[0059] After detecting error in the content in the CRC (cyclic redundancy check) method according to the playback 
code transferred from the flash memory 61 , the DSP 59 will play back the content and the played-back data (indicated 

55 with a reference D1 in FIG. 3) to a digital/analog conversion circuit 63. 

[0060] The DSP 59 is formed integrally with a transmission circuit (not shown) provided inside the portable device 
6 to play back a content based on a master clock MCLK from an external crystal oscillator 59A, and supplies the digital/ 
analog conversion circuit 63 with the master clock MCLK, a bit clock BCLK generated by an internal oscillation circuit 
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based on the master clock MCLK and having a predetermined frequency, and an operating clock LRCLK composed 
of an L-channel clock LCLK and R-channel clock RCLK in the units of frames. 

[0061] For playing back a content, the DSP 59 will supply the above-mentioned operating clock to the digital/analog 
conversion circuit 63 according to the playback code. When playing back no content, the DSP 59 will stop supplying 
5 the operating clock according to the playback code to turn off the digital/analog conversion circuit 63, thereby reducing 
the power consumption of the entire portable device 6. 

[0062] Similarly, the CPU 53 and USB controller 57 have external crystal oscillators 53A and 57A connected thereto, 
respectively, and effect predetermined operations on the basis of master clocks MCLK supplied from the oscillators 
53A and 57A, respectively. 

10 [0063] Because of the above-mentioned construction, the portable device 6 needs no clock generation module to 
supply a clock to each of the CPU 53, DSP 59 and USB controller 57 and thus can be designed to have a simpler and 
more compact circuit construction. 

[0064] The digital/analog conversion circuit 63 converts a played-back content to an analog audio signal and supplies 
it to an amplification circuit 64. The amplification circuit 64 amplifies the audio signal and supplies it to headphone via 
15 a headphone jack 65. 

[0065] Thus, when the play/stop button is pressed, the portable device 6 plays back a content stored in the flash 
memory 61 under the control of the CPU 53. When the play/stop button is pressed in the course of playing back a 
content, the portable device 6 will stop playing back the content. 

[0066] When the play/stop button is pressed after stopping the content playback operation, the portable device 6 will 
so resume the content playback at the position where the playback operation has been stopped under the control of the 
CPU 53. When a time of a few seconds has passed with no additional operation effected after the playback operation 
is stopped by pressing the play/stop button, the portable device 6 will automatically shut off the power supply, thereby 
reducing the power consumption. 

[0067] It should be noted here that when the play/stop button is pressed after the power supply is turned off, the 
25 portable device 6 will resume the playback at the first music piece or music piece No. 1 without playing back the content 
at the position where the playback operation has p'eviously been stopped. 

[0068] Also, the CPU 53 of the portable device 6 makes an LCD controller 68 display on a display unit 67 a playback 
mode (e g , repeated play, introducing play, etc), equalization adjustment (i.e., gain adjustment for a frequency band 
of the audio signal), number for music piece, playing time, operation modes such as play, stop, fast forward and fast 
30 rewind, and information such as sound volume and voltage level in the dry cell 51 . 

[0069] Further, the portable device 6 stores into an EEPROM 68 a number of contents written in a flash memory 80, 
locations of blocks of the flash memory 6 1 in which contents are written, respectively, and a so-called FAT (file allocation 
table) for various information stored in the memory. 

[0070] It should be noted that in this embodiment, a content is taken as one block of 64 kbytes and a location of the 

35 block for the content of each music piece is stored in the FAT. 

[0071] In case a FAT is stored into the flash memory 61 , when the content of a first music piece is written into the 
flash memory 61 under the control of the CPU 53, the location of a block corresponding to the content of the first music 
piece will be written as FAT into the flash memory, and then when the content of a second music piece is written into 
the flash memory 61, the location of a block corresponding to the content of the second music piece will be written as 

40 FAT into the flash memory 61 (in the same area as that in which the first music piece has already been written). 

[0072] In this way, a FAT is rewritten each time the content is written into the flash memory 61 and further the same 
data will be written again for reservation to protect the data. 

[0073] When FAT is written into the flash memory 61, the same area in the flash memory will be rewritten twice 
correspondingly to the write of the first content. For this reason, when content write has been made a small number 
45 of times, a specified number of times for rewrite of the flash memory 61 will be reached, so that the flash memory. 61 
will not be rewritable any longer. 

[0074] To avoid the above, the portable device 6 makes the EEPROM 68 store FAT so that FAT will be rewritten a 
reduced number of times in the flash memory 61 at write of each content. 

[0075] By storing into the EEPROM 68 a FAT which is rewritten a large number of times, the portable device 6 can 
so be adapted such that content can be written into the flash memory 61 at a frequency tens times larger than that at 
which FAT is stored into the flash memory 61. Further, since the CPU 53 makes the EEPROM 68 additionally store 
FAT, the same area in the EEPROM 68 is rewritten at a reduced frequency to prevent the EEPROM 68 from early 
becoming not rewritable. 

[0076] When the portable device 6 is connected to the personal computer 1 by the USB cable 7 (which will be referred 
55 to as "USB connection" hereinafter), it is recognized based on an interrupt signal supplied from the USB controller 57 
to the CPU 53 that the USB connection has been made. 

[0077] When the portable device 6 recognizes the USB connection, it is supplied with an external power of a specified 
current value from the personal computer 1 via the USB cable 7, and makes a power circuit 52 stop the power supply 
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from the dry cell 51 . 

[0078] When the USB connection is established, the CPU 53 will stop the DSP 59 from playing back a content. Thus, 
the CPU 53 will prevent the external power supplied from the personal computer 1 from exceeding the specified current 
value so that the external power of the specified current value can always be supplied, 
s [0079] Thus, when the USB connection is established, the CPU 53 makes a selection between the power supplied 
from the dry cell 51 and the power supplied from the personal computer 1 . That is, the inexpensive external power 
from the personal computer 1 can be used, and so the costly power supplied from the dry cell 51 and which costs high 
is less consumed. Thus, the dry cell 51 can be used for a longer service life. 

[0080] Note that when supplied with the external power from the personal computer 1 via the USB cable 7, the CPU 
'0 53 stops the DSP 59 from playing back a content to reduce the radiation from the DSP 59, so that the radiation of the 
entire system including the personal computer 1 can further be reduced 

[0081] The functions of the personal computer 1 implemented by execution of programs installed in the personal 
computer 1 will be explained in the following. 

[0082] Referring now to FIG. 4, there is illustrated a diagram of the personal computer 1 , explaining the functions of 

'5 the personal computer 1 , implemented by execution of predetermined programs. 

[0083] As shown, the personal computer 1 uses a content management program 1 1 1 which is composed of a plurality 
of programs including an EMD selection program 131 , check-in/check-out management program 132, copy manage- 
ment program 133, move management program 134, encryp;ion method conversion program 135, compression meth- 
od conversion program 136, encryption program 137, compression/expansion program 138, usage rule conversion 

20 program 139, usage rule management program 140, authentication program 141 , decryption program 142, PD driver 
143, purchase programs 144 and 145. 

[0084] Of the above programs, the content management program 1 1 1 is composed of shuffled or encrypted instruc- 
tions, for example, to conceal the instructed operations from outside to make it difficult to interpret the instructions (for 
example, even if the user can read directly the content management program 111 , he or she cannot identify the in- 
ss structions 

[0085] The EMD selection program 131 is not included in the content management program 111 when the latter is 
installed in the personal computer 1 but it is received from the EMD registration server 3 via the network 2 at the time 
of EMD registration . The EMD selection program 131 selects a connection with the EMD server 4 (4-1 to 4-3) to enable 
a purchase application program 115, purchase program 144 or 145 to have a communication with the EMD server 4 

30 (4-1 to 4-3) (e.g., download of a content for purchase). 

[0086] Based on a setting of either check-in or check-out and usage rule files 1 62-1 to 1 62-N recorded in a content 
data base 114, the check-in/check-out management program 132 checks out contents stored in content files 161-1 to 
1 61 -N to any of the portable device 6, or checks in contents stored in the portable device 6. 
[0087] In response to the check-in or check-out having been done, the check-in/check-out management program 

35 132 updates the usage rule stored in the usage rule files 162-1 to 162-N recorded in the content data base 114. 

[0088] Based on the usage rule files 162-1 to 162-N recorded in the content data base 114, the copy management 
program 133 copies contents stored in the content files 161-1 to 161-N to any of the portable device 6, or copies 
contents from the portable device 6 to the content data base 114. 

[0089] Also based on the usage rule files 162-1 to 1 62-N recorded in the content data base 114, the move manage- 
■*o ment program 134 moves contents stored in the content files 161-1 to 161-N to any of the portable device 6, or contents 
from the portable device 6 to the content data base 114. 

[0090] The encryption method conversion program 135 converts, to the same encryption method as that used with 
the contents stored in the content files 161-1 to 161-N recorded in the content data base 114, the encryption method 
used with a content the purchase application program 115 receives from the EMD server 4-1 via the network 2, a 

■*s content the purchase program 144 receives from the EMD server 4-2 via the network 3. 

[0091] The compression method conversion program 136 converts, to the same compression method as that used 
with the contents stored in the content files 161-1 to 161-N recorded in the content data base 114, the compression 
method used with a content the purchase application program 1 1 5 receives from the EMD server 4-1 via the network 
2, a content the purchase program 144 receives from the EMD server 4-2 via the network 2. 

so [0092] The encryption program 1 37 is used to encrypt a content (not encrypted) read from a CD and supplied from 
a recording program 113 for example to the same encryption method as that used with contents stored in the content 
files 161-1 to 161-N recorded in the content data base 114. 

[0093] The compression/expansion program 1 38 encodes a content (not compressed) read from a CD and supplied 
from the recording program 113 by the same encoding method as that used with contents stored in the content files 
55 161-1 to 161-N recorded in the content data base 114. In addition, the compression/expansion program 138 will expand 
(decrypt) a coded content. 

[0094] The usage rule conversion program 139 converts, to the same format as that of the usage rule stored in the 
usage rule files 1 62-1 to 1 62-N recorded in the content data base 1 1 4, a usage rule for a content the purchase application 
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program 115 receives from the EMD server 4-1 via the network 2, a content the purchase program 144 receives from 
the EMD sever 4-2 via the network 2. 

[0095] Before execution of content copy, move, check-in or check-out, the usage rule management program 140 
detects a falsification or alteration of the usage rules based on hash values (which will further be described later) 
5 meeting the usage rules stored in the usage rule files 162-1 to 162-N recorded in the content data base 114. As the 
usage rules stored in the usage rule files 162-1 to 162-N recorded in the content data base 114 are updated along with 
a content copy, move, check-in or check-out, the usage rule management program 140 updates the hash values meet- 
ing the usage rules. 

[009G] The authentication program 1 41 executes a mutual authentication between the content management program 
io 111 and purchase application program 111 , and a mutual authentication between the content management program 
115 and purchase program 144. Also, the authentication program 141 will store an authenticate key used in the mutual 
authentication between the EMD server 4-3 and purchase program 145. 

[0097] It should be noted that when the content management program 111 is installed in the personal computer 1 , 
the authenticate key the authentication program 141 used in the mutual authentication is not yet stored in the authen- 
15 tication program 141 but when a display/operation-instructive program 112 has successfully registered the authenticate 
key, the key will be supplied from the EMD registration server 3 and stored in the authentication program 141. 
[0098] The decryption program 1 42 decrypts a content when the personal computer 1 plays back the content stored 
in the content files 161-1 to 161-N recorded in the content data base 114. 

[0099] When checking put a predetermine content to the portable device 6 or checking in a predetermined content 
so from the portable device 6, the PD driver 143 supplies the portable device 6 with the content or a command making 
the portable device 6 do a predetermined operation. 

[0100] The purchase program 144 is installed along with the content management program 111 into the personal 
computer 1 , supplied from the EMD registration server 3 via the network 2, or supplied as recorded in a predetermined 
CD. When installed in the personal computer 1 , the purchase program 144 will transmit or receive the content man- 
25 agement program 111 and data via an interface of a predetermined form the content management program 111 has 
[0101] The purchase program 144 is composed of shuffled or encrypted instructions, for example, to conceal the 
instructed operations from outside to make it difficult to interpret the instructions (for example, even if the user can 
read directly the purchase program 1 44, he cannot identify the instructions. 

[0102] The purchase program 144 requests, via the network 2, the EMD server 4-2 to send a predetermined content 
30 and thus receives the content from the EMD server 4-2. Upon reception of the content from the EMD server 4-2, the 
purchase program 144 will account for the content. 

[0103] The purchase program 145 is to be installed along with the content management program 111 . It requests, 
via the network 2, the EMD server 4-3 to send a predetermined content and thus receives the content from the EMD 
server 4-3. Upon reception of the content from the EMD server 4-3, the purchase program 145 will account for the 
35 content. 

[0104] Based on a filtering data file 181, display data file 182, image files 1B3-1 to 1 83-K or a history data file 184, 
the display/operation-instructive program 112 displays an image of a predetermined window on the display unit 20, 
and gives a check-in or check-out instruction to the content management program 111 in response to an operation of 
the keyboard 1 8 or mouse 1 9 by the user. 
*o [0105] The filtering data file 181 stores data for weighting contents stored in the content files 161-1 to 161-N recorded 
in the content data base 1 1 4, and is recorded in the HDD 21 . 

[0106] The display data file 182 stores data corresponding to the contents stored in the content files 161-1 to 161-N 
recorded in the content data base 114, and is recorded in the HDD 21 . 

[0107] The image files 183-1 to 183-K store images corresponding to the content files 161-1 to 161-N recorded in 
45 the content data base 114 or images corresponding to packages which will further be described later, and are recorded 
in the HDD 21. 

[0108] The image files 183-1 to 183-K will be referred to simply as "image file 183" hereafter wherever they have 
not be referred to individually. 

[0109] The history data file 184 stores history data including a number of times the contents stored in the content 
50 files 161-1 to 161-N recorded in the content data base 114 have been checked out, a number of times the contents 
have been checked in, and the dates on which the check-out an check-in were made. The history data file 184 is 
recorded in the HDD 21. 

[0110] For the registration, the display/operation-instructive program 112 transmits, via the network, an ID of the pre- 
stored content management program 111 to the EMD registration server 3, while receiving, via the network 2, the 
55 authenticate key and EMD selection program 1 31 from the EMD registration server 3 and supplying them to the content 
management program 1 1 1 . 

[0111] The recording program 113 is used to display an image of a predetermined window, and read data such as 
a recording time of a content from a CD being the optical disc 42 set in the drive 22 in this embodiment in response to 
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an operation of the keyboard 1 8 or mouse 1 9 by the user. 

[01 1 2] Based on a recording time of a content recorded in a CD, the recording program 113 requests, via the network 
2, the WWW server 5-1 or 5-2 to send data corresponding to the CD such as album name or artist's name or data 
corresponding to a content recorded in the CD such as a music piece title, and thus receives, via the network 2, the 
s data corresponding to the CD or the content recorded in the CD from the WWW server 5-1 or 5-2. 

[01 1 3] Also, the recording program 1 1 3 supplies the display/operation-instructive program 1 1 2 with the received data 
corresponding to the CD or data corresponding to the content recorded in the CD. 

[01 1 4] Further, when supplied with a recording instruction, the recording program 1 1 3 reads and outputs to the content 
management program 111a content from a CD being the optical disc 42 set in the drive 22 in this embodiment. 

10 [0115] The content data base 114 stores into any of the content files 161-1 to 161-N a content supplied from the 
content management program 1 1 1 and having been compressed in a predetermined manner and encrypted in a pre- 
determined manner (records the content into the HDD 21). The content data base 114 stores usage rules for contents 
stored in the content files 161-1 to 161-N into any of the usage rule files 162-1 to 162-N corresponding to the content 
files 161-1 to 161-N in which the contents are stored (records the usage rules into the HDD 21). 

'5 [0116] The content data base 114 may record the content files 161-1 to 161-N or usage rule files 162-1 to 162-N as 
records. 

[0117] A usage rule for a content stored in the content file 161-1 for example is stored in the usage rule file 162-1. 
A usage rule for a content stored in the content file 161-N is stored in the usage rule file 162-N. 
[01 1 8] The content files 161-1 lo 1 61 -N will be referred Lo simply as "content file 161" hereinafter wherever they have 
20 not be referred to individually. Also, the usage rule files 162-1 to 162-N will be referred to simply as "usage rule file 
162" hereafter wherever they have not to be referred to individually. 

[0119] The purchase application program 115 is supplied from the EMD registration server 3 via the network 2 or as 
recorded in a predetermined CD-ROM The purchase application program 1 1 5 requests, via the network 2, the EMD 
server 4-1 to send a predetermined content, while thus receiving the content from the EMD server 4-1 and supplying 
25 it to the content management program 111 . Also, upon reception of the content from the EMD server 4-1 , the purchase 
application program 115 will account for the content. 

[0120] Next, the correspondence between data stored in the display data file 82 and the content files 161-1 to 161-N 
stored in the content data base 114 will be described herebelow: 

[0121] Firstly, a content stored in any of the content files 161-1 to 161-N belongs to a predetermined package. More 
30 specifically, the package is any of an original package, my selected package and filtering package. 

[0122] Of the above packages, the original package has more than one content belonging thereto. This package 
corresponds to the content classification (namely, so-called album) in the EMD server 4 orto one CD. A content belongs 
to any original package and cannot belong to a plurality of original packages. Also, an original package to which a 
content belongs cannot be modified. The user can edit a part of information corresponding to an original package (for 
35 example, addition of information or change of added information). 

[0123] More than one content freely selected by the user belong to the my selected package. The user can arbitrarily 
edit contents for assignment to my selected packages, respectively. A content can belong to more than one my selected 
package at a time Also, a content may not belong to any my selected package. 

[0124] Contents selected based on a filtering data stored in a filtering data file 181 belong to the filtering package. 
J0 The filtering data is supplied from the EMD server 4 or WWW server 5 via the network 2 or as recorded in a predeter- 
mined CD. The user can edit the filtering data stored in the filtering data file 1 81 . 

[01 25] The filtering data is a reference for selection of a predetermined content or for calculation of a weight corre- 
sponding to the content. For example, filtering data corresponoing to top tens of the weekly J-POP (Japanese pops) 
can be used by the personal computer 1 to identify contents of the weekly Japan Pops Nos. 1 to 1 0. 

45 [0126] The filtering data file 181 includes a filtering data for selection of contents in the descending order of the 
lengths of period for which they have been checked out for the past one month, a filtering data for selection of contents 
in the descending order of the numbers o( times they have been checked out (or the past half year, or a filtering data 
for selection of contents in which a character "Al (love)" is included in the music piece titles (content name). 
[0127] Thus, contents in the filtering package are selected by comparing a filtering data with a content display data 

50 221 (including data the user has set), a history data 184 or the like 

[01 28] The driver 1 1 7 drives the audio input/output interface 24 under the control of the content management program 
111 or the like to input a content being a digital data supplied from outside and supply it to the content management 
program 111, output as a digital data a content supplied from the content data base 1 1 4 via the content management 
program 111, or output an analog signal corresponding to a content supplied from the content data base 114 via the 

55 content management program 111. 

[0129] FIG. 5 shows an example of the display/operation-instructive window the display/operation-instructive pro- 
gram 1 1 2 makes the display unit 20 display 

[0130] There are displayed in the display/operation-instructive window a button 201 for starting up the recording 
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program 113, a button 202 for starting up the EMD selection program 131, a button 203 for displaying a field in which 
check-in or checkout is set", a button 204 for displaying a field in which a my selected package is to be edited, etc. 
[0131] When a button 205 is selected, data corresponding to an original package is displayed in a field 211 of the 
window. When a button 206 is selected, data corresponding to a my selected package is displayed in the field 211 . 
5 When a button 207 is selected, data corresponding to a filtering package is displayed in the field 211 . 

[0132] Data displayed in the field 211 concerns a package. For example, it is a package name or an artist's name. 
[0133] As shown in FIG. 5, there are displayed in thefield 211 a package name "FIRST" and artist's name "A TARO", 
a package name "SECOND" and artist's name "A TARO", etc. 

[01 34] The display/operation-instructive window has also a field 21 2 in which there is displayed data corresponding 
io to a content belonging to a packet selected in the field 211 . Data displayed in the field is a music piece title, playing 
time or a number of times the content can be checked out. 

[0135] In FIG. 5, a package corresponding to the package name "SECOND" is selected. So, there are displayed in 
the field 212 the music piece title (content name) "MINAMI-NO-SAKABA" corresponding to the content belonging to 
the package corresponding to the package name "SECOND", a number of times the content can be checked out (for 
'5 example, one eighth note is for one check-out and two eighth notes are for two check-out's), and music piece title 
(content name) "KITA-NO-HAKABA" and number of times the content can be checked (for example, one eighth note 
corresponds to one check-out). 

[0136] Thus, one eighth note as a number of times a content can be checked out, displayed in the field 21 2, indicates 
that a corresponding content can be checked out once. 
20 [0137] A rest as a number of times a content can be checked out, displayed in 1he field 212, indicates that a corre- 
sponding content cannot be checked out (the number of check-out's is zero; however, the personal computer 1 can 
play back that content). A C clef as a number of times a content can be checked out, displayed in the field 212, indicates 
that the number of check-out's for a corresponding content is limitless (the content can be checked out any number of 
times). 

25 [0138] Note that the number of times a content can be checked out may be indicated with a corresponding number 
of pieces of a predetermined figure (for example, it may be a circle, star, crescent or the like) as shown in FIG. 5 as 
well as a number, 

[0139] Also there is displayed in the display/operation-instructive window a field 208 in which an image or the like 
corresponding to a selected package or content (corresponding to any of the image files 183-1 to 183-K in FIG. 4) is 
30 displayed. In this field, a button 209 is clicked when playing back a selected content (outputting a sound corresponding 
to the content to the speaker 45). 

[0140] When a music piece title of a predetermined content (content name) displayed in the field 21 2 is selected and 
a deleting operation is made while the button 205 is selected and data corresponding to an original package is being 
displayed in the field 211, the display/operation-instructive program 112will make the content management program 
35 111 delete the predetermined content stored in the content data base 114, corresponding to the selected music piece 
title. 

[0141] When a content read from a CD is recorded into the content data base 114 while a button 255 (which will 
further be described later) in the window displayed under the control of the recording program 1 1 3 is being selected 
(made active), the display/operation-instructive program 112 will make the display/operation-instructive window display 
■to a field 213 in which there is displayed a music piece title of a content (content name) stored in the pre-designated 
portable device 6. 

[0142] When a content read from a CD is recorded into the content data base 114 while a button 255 (which will 
further be described later) in the window displayed under the control of the recording program 113 is being selected 
(made active), the display/operation-instructive program 112 will make the content management program 111 check 

4 5 out the content recorded in the content data base 114 and read from the CD to the pre-designated portable device 6. 
[0143] There is displayed in the field 213 at the leftmost position thereof corresponding lo the music piece title of a 
content (content name) a symbol indicating whether the content can be checked in to the personal computer 1. For 
example, a symbol "O" at the leftmost position of the field 213 indicates that a content corresponding to a music piece 
title of a content can be checked in to the personal computer 1 (that is, it has been checked out from the personal 

so computer 1). A symbol "x" at the leftmost position of the field 213 indicates that a content corresponding to a music 
piece title of a content cannot be checked in to the personal computer 1 (that is, it has not been checked out from the 
personal computer 1 ; for example, it has been checked out from any other personal computer). 
[0144] When the display/operation-instructive program 112 has displayed the field 213 in the display/operation-in- 
structive window, the display/operation-instructive program 112 will display in the display/operation-instructive windowa 

55 field 214 in which the name of a portable package (to which a content stored in the pre-designated portable device 6 
belongs) is displayed, a button 210to close thefield213, anda button 215to execute a check-in or check-out operation. 
[0145] Further, when the display/operation-instructive program 112 has displayed thefield 213 in the display/oper- 
ation-instructive window, the display/operation-instructive program 112 will display in the display/operation-instructive 
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window a button 21 6 to set a check-out operation for a content corresponding to a music piece title selected in the field 

212, a button 217 to set a check-in operation for a content corresponding to a music piece title selected in the field 

213, a button 218 to set a check-in operation for all contents corresponding to content names displayed in the field 
213, and a button 219 to cancel the check-in or check-out setting. 

5 [0146] Even with the check-in or check-out setting made by using the buttons 216 to 219, however, the personal 
computer 1 will not execute the check-in or check-out operation. 

[0147] When the button 21 5 is clicked after a check-in or check-out is set by using the buttons 21 6 to 21 9, the display/ 
operation-instructive program 1 1 2 will make the content management program 111 execute the check-in or check-out. 
That is to say, when the button 215 is clicked, the display/operation-instructive program 112 will make, based on the 
10 check-in or check-out setting, the content management program 111 transmit a content, or a command to erase a 
predetermined content corresponding to the check-in setting (e.g., a command to erase a predetermined content stored 
in the portable device 6), to the portable device 6, and to update the usage rule stored in the usage rule file 162 
corresponding to the content or command thus transmitted. 

[0148] When the check-in or check-out is executed, the display/operation-instructive program 112 will respond to 
' 5 the transmitted content or command to update the history data stored in the history data file 184. The history data 
includes information for identification of a content having been checked in or out or a date when the content has been 
checked in or out, and the name of the portable device 6 from which the content has been checked out. 
[01 49] Since the check-in or check-out can be set in a short time, the user can quickly know the status after execution 
of a check-in or check-out operation, whereby the number of limes a time-taking check-in or check-out operation is 
20 done can be reduced to minimize the total time (including the setting and execution of a check-in or check-out operation) 
taken for the check-in or check-out procedure. 

[0150] FIG. 6 shows an example of the window which the recording program 113 makes the display unit 20 display. 
[0151] Based on CD information received from the WWW server 5-2 for example, the recording program 113 will 
display a CD title such as "ACYNCHRONIZED" in a field 251. Also, based on CD information received from the WWW 

25 server 5-2, the recording program 113 will display an artist's name such as "KUWAI" in afield 252. 

[0152] Based on CD information received from the WWW server 5-2, the recording program 113 will display titles of 
music pieces such as "HEAT", "PLANET", "BLACK", "SOUL", etc. in a region of a field 253 where music piece titles 
are to be displayed Similarly, the recording program 113 will display an artist's name such as "KUWAI" is a region of 
the field 253 where artists' names are to be displayed. 

30 [01 53] After receiving a predetermined CD information, the recording program 113 will store it into a predetermined 
directory in the HDD 21. 

[0154] Upon reception of an instruction for acquisition of CD information via clicking of a button 254, the recording 
program 113 will first search the predetermined directory in the HDD 21 . When the CD information is found stored in 
the directory, the recording program 113 will display a dialogue box (not shown) to prompt the user for selection of 

35 whether he or she is going to use the CD information stored in the directory. 

[0155] When a button 256 displayed in the window displayed by the recording program 113 and which instructs to 
start recording of a content, is clicked, the recording program 113 will read a content from a CD set in the drive 22, and 
supply it along with the CD information to the content management program 111. The compression/expansion program 
138 of the content management program 111 compresses the content supplied from the recording program 113 in a 

40 predetermined manner and the encryption program 1 37 encrypts the compressed content. Also, the usage rule con- 
version program 139 generates a usage rule for the compressed and encrypted content. 

[0156] The content management program 111 will supply the compressed and encrypted content along with the 
usage rule to the content data base 114. 

[0157] The content data base 114 will generate a content file 161 and usage rule file 162 for the content received 
45 from the content management program 111, and store the content into the content file 161 and the usage rule into the 
usage rule file 162. 

[0158] When the content and usage rule for the content are stored into the content data base 114, the content man- 
agement program 111 will supply the CD information and usage rule received from the recording program 113 to the 
display/operation-instructive program 112. 

so [0159] The display/operation-instructive program 112 will a display data for storage into the display data file 182 
according to the usage rule for the content stored in the content data base 114 by the recording and the CD information. 
[0160] The window displayed by the recording program 113 has displayed therein a button 255 to automatically set 
whether the portable device is made to check out a content read 1rom the CD when the content read from the CD is 
recorded into the content data base 114. 

55 [0161] For example, when the button 255 is clicked, the recording program 1 1 3 will display a pull-down menu showing 
the portable device 6. When the user selects the portable device 6 from the pull-down menu, the personal computer 
1 will automatically check out the content recorded from the CD to the selected portable device 6. When the user 
selects "NOT CHECK OUT" from the pull-down menu, the personal computer 1 will not check out the content recorded 
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from the CD. 

[0162] Thus, when the content read from the CD is recorded into the content data base 114 with only the button 255 
in the window displayed by the recording program 113 being set active, the personal computer 1 can make any pre- 
designated one of the portable devices 6-1 to 6-3 check out the content read from the CD. 

5 

(2) Handling between Different Formats 

[0163] Meanwhile, there are numerous contents disitibjto-s lurnishing tho music contents, with the encryption sys- 
tems of the contents and the formats of the using cordii on inlDrmalion differing from one distributor to another. So, 
10 the user at larger has to purchase contents management applications or portable devices for reproduction or check- 
in/check-out different from one distributor of contents desired to be furnished to another, and hence the user cannot 
handle the music contents stored on a personal computer by a sole management application or by a sole portable 
device. 

[0164] So, the present system envisages to nandle the contents having different formats from one distributor to 
15 another on the personal computer 1 in a unified lashicn 

- [0165] Referring to Fig. 7, unified handling of contents having dittcrcnt formats from one distributorto another, in this 
music contents distributing system, is explained wi;h reference to Fig. 7. 

[0166] It is assumed that the plural EMD servers 4. connected to ihe network 2, are an EMD server A4-1 , distributing 
the music contents furnished by a music furnishing firm A. an EMDscrvcr B4-2, distributing the music contents furnished 

20 by a music furnishing firm B and an EMD servei X4-3. distributing the music contents furnished by a music furnishing 
firm X. These EMD servers 4 (4-1 , 4-2 and 4-3) furnish ihc music contents of a line-up each being unique to each firm, 
over a network 2 to a personal computer 1 owned by a user. Moreover the respective EMD servers 4 (4-1 , 4-2 and 
4-3) distribute the music contents in respective different styles, by the servers 4 adopting encryption systems of music 
contents, formats of the using condition (usage rule) information, music contents compression systems and charging 

25 systems for the motion compensation, which are unique to the servers. 

[0167] In the personal computer 1 , there are installed, as application software (or reproduction or management of 
the music contents, a reproduction application A311. for purchasing, supervising and reproducing music contents from 
the EMD server A4-1 , a reproduction application B312. for purchasing, supervising and reproducing music contents 
from the EMD server B4-2, a device driver A31 3 for transferring the music contents to the portable device A6-1 and a 

30 device driver B31 4 for transferring the music contents to the portable device B6-2. Meanwhile, the reproduction appli- 
cation 311, 312, shown in Fig.7, correspond to the application program 115 for purchase and the driver 117, shown in 
Fig. 4. respectively. 

[0168] In the personal computer 1, there are installed a comprehensive management unit X 315. for managing com- 
prehensive control of the totality of music contents stored in the HDD 21 . This comprehensive management unit X 31 5 

35 is made up of a reception interface 316 for EMD. a transmission interface for EMD 31 7 and a driver for PD 318. 

[0169] It is assumed here that the portable device A6-1 is a dedicated device for coping with a music furnishing firm 
A, the portable device B6-2 is a dedicated device for coping with a music furnishing firm B and the portable device 
X6-3 is a dedicated device for coping with a music furnishing firm X. It is also assumed that the music contents stored 
in a memory card are encrypted in accordance with an encryption system unique to each music furnishing firm, with 

40 the formats for the using condition information or the compression systems being also different, so that no music 
contents can be transferred on connection directly e.g., to olher device drivers. 

[0170] The reproduction application A 311 performs the processing for connecting to the EMD server, uploading e. 
g., a log file and downloading music contents, contents keys and using condition intormation. I his reproduction appli- 
cation A311 is adapted for performing connection processing only to the EMD server the application is able to cope 

45 with. Here, the reproduction application A311 is adapted for performing the processing associated with the EMD server 
4-1 , while it is unable to perform connection processing to any other EMD servers. The reproduction application 
A311also is adapted for performing the processing for authentication on connection to the EMD server A 4-1, the 
processing for authentication on connection to the portable device A6-1 and the processing for encryption/decryption 
of the music contents and the using condition information stored in the HDD 21 . The reproduction application A311 

so encrypts the music contents, downloaded from the EMD server 4-1 and the corresponding using condition information 
with the contents key and encrypts the contents key with the session key to store the encrypted key in the HDD 21 . 
Meanwhile, the respective reproduction applications adopt respective unique encryption systems, so that the music 
contents stored in the same HDD 21 in the personal computer 1 cannot decrypt other reproduction applications than 
the dedicated reproduction application. 

55 [0171] The reproduction application A311 also manages the using condition information appended to each music 
contents. For example, if a limit value forthe number of times of reproduction is stated in the using condition information, 
such that limitations are imposed on the number of times of possible contents reproduction, the reproduction application 
A311 decrements the limit value of the number of times of reproduction or duplication by 1 for each reproduction or 
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duplication. 

[0172] The reproduction application A31 1 also transmits the music contents and the using condition information it 
manages on the HDD 21 to the reception interface 316 for EMD of the comprehensive management unit X 315. 
[0173] The reproduction application B312 performs the processing of connection to the EMD server, uploading e.g., 
a log file and downloading the music contents, contents key or the using condition information. This reproduction 
application B312 is adapted for performing the processing for connection only to the EMD server the application is able 
to cope with. Specifically, the reproduction application B312 is able to perform the processing associated with the EMD 
server4-2, while it is unable to perform the processing for connection to the other EMD servers. The reproduction 
application B31 2 performs the processing for authentication on connection to the EMD server4-2, the processing for 
authentication on connection to the portable device B6-2 and the processing for encrypting/decrypting the music con- 
tents and the using condition information stored in [he HDD 21. For example, the reproduction application B31 2 encrypts 
the music contents downloaded from the EMD server4-2 and the corresponding using condition information, with the 
contents key, while encrypting the contents key with a session key and saving the encrypted contents key in the HDD 21 . 
[0174] The reproduction application B312 also manages the using condition information appended to the respective 
music contents. For example, if a limit value for the number of times of reproduction is stated in the using condition 
information, such that limitations are imposed on the number of times of possible contents reproduction, the reproduc- 
tion application B312 decrements the limit value of the number of times of reproduction or duplication by 1 for each 
reproduction or duplication. 

[0175] The reproduction application B312 also transmits the music contents and the using condition information it 
manages on the HDD 21 to the reception interface 316 lor EMD of the comprehensive management unit X 315. 
[0176] The device driver A31 3 is an application software for transferring music contents to the portable device A6-1. 
The device driver A31 3 transmits the music contents to the portable device A6-1 . 

[0177] The device driver B31 4 is an application software for transferring music contents to the portable device B6-2. 
The device driver B314 transmits the music contents to the portable device B6-2. 

[0178] The comprehensive management unit (X)315 is an application software, dedicated to the music furnishing 
company X. and which is furnished with the music contents from the EMD server (X) 4-3. The comprehensive man- 
agement unit (X)315 is also a supervising software for transferring the music contents and the using condition infor- 
mation between it and the device driver (A) 313, device driver (B) 314, reproducing application (A) 311 and the repro- 
ducing application (B) 312 to manage the music contents in the personal computer 1 comprehensively. The compre- 
hensive management unit (X)315 is also able to transfer the music contents it is supervising to the dedicated portable 
device 6-3 which is the portable music reproduction device. 

[01 79] The comprehensive management unit (X)31 5 performs processing corresponding to the content management 
program 111 shown in Fig.4. 

[0180] The projection display unit 31 8 is an interfacing module for connection to the portable device 6-3 and executes 
the authentication processing and the encryption processing between it and the portable device 6-3. Moreover, in 
transferring music contents etc to other portable devices 6-1, 6-2, the projection display unit 318 transfers the music 
contents and the using condition information through the device driver (A) 313 or the device driver (B) 314. 
[0181] The reception interface for EMD 316 receives the music contents and the using condition information from 
the reproducing application (A) 311 and the reproducing application (B) 312, while receiving the music contents and 
the using condition information transferred from the EMD server (X) 4-3 through the network 2 and exchanging the 
music contents and the using condition information with the PD driver 318. 

[0182] In receiving the music contents and the using condition information from the reproducing application (A) 311 
and the reproducing application (B) 312, the reception interface for EMD 316 performs reciprocal authentication, con- 
version of the encryption system, conversion of the format tor the using condition information etc., appended to the 
music contents being transferred and conversion of the compression system of the music contents being transferred. 
The encryption system, using condition information or the compression system used by the reproducing application 
(A) 311 and the reproducing application (B) 312 is changed to the system used by the comprehensive management 
unit (X)315. The system used by the comprehensive management unit (X)315 is referred to below as a unified transfer 
protocol. The reception interface for EMD 316 transmits the music contents and the using condition information, thus 
converted to the unified transfer protocol, the device driver (A) 313 or the device driver (B) 31 4 through the PD driver 
318. The reception interface for EMD 316 also transmits the music contents and the using condition information, con- 
verted to the unified transfer protocol, to the portable device 6-3 through the PD driver 318. 

[0183] The music contents provided from the EMD server (A) 4-1 and the EMD server (B) 4-2 are once downloaded 
by the reproducing application (A) 311 and the reproducing application (B) 312, and the encryption system, the com- 
pression system , and the using condition information of the music contents are converted to the unified transfer protocol 
and are transferred to the comprehensive management unit (X)315. The comprehensive management unit (X)315 
comprehensively supervises the music contents of the contents furnishing companies down loaded from the EMD server 
(A) 4-1 , EMD server (B) 4-2 and from the EMD server (X) 4-3. 
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[0184] The reception interface for EMD 31 6 also has the function of copying moving, and performing check-in and 
check-out of the music contents. 

[0185] The reception interface for EMD 316 performs the processing of copying or moving the music contents stored 
in the reproducing application (A) 311 to the reproducing application (B) 312, in accordance with the command for 
s copying or movement from the user. At this time, the reception interface for EMD 31 6 converts the encryption system 
of the music contents, compression system or the statement format of the use conditions into the unified transfer 
protocol 

[0186] The reception interface for EMD 316 also performs the processing of copying and checking-in the music 
contents stored in external media, such as Compact Disc, or in the portable devices 6-1 to 6-3, into the comprehensive 
10 management unit (X)315, in accordance with the CD ripping command or the check-in command from the user. If, at 
this time, the encryption system or the compression system of the music contents or the description format of the using 
conditions are not converted lo the unified transfer protocol, the reception interface for EMD 316 makes the conversion 
into the unified transfer protocol. 

[0187] The reception interface for EMD 316 also performs the processing of recording the music contents managed 
'5 by the comprehensive management unit (X)315 in the portable device 6-3 in accordance with a check-out command 
from the user. If, at this time, the encryption system or the compression system of the music contents or the description 
format of the using conditions are not converted to the unified transfer protocol, the reception interface for EMD 316 
makes the conversion into the unified transfer protocol. Also, at this moment, the available number of check-out of the 
using condition is decreased by one. 
so [0188] The comprehensive management unit (X)315 has the unified transfer protocol in a lower application layer in 
which to transfer data to other purchase applications, as shown in Fig. 8. The comprehensive management unit (X)315 
has data transmission/reception with the EMD server (X) 4-3, with a layer below the unified transfer protocol as http 
(hyper text transfer protocol). 

[0189] In the above-described music contents distributing system, the music contents distributed from the EMD serv- 
es er (A) 4-1 and the EMD server (B) 4-2 are acquired by the comprehensive management unit (X)315 for reproduction 
or management. Also, the music contents distributed from the EMD server (X) 4-3, EMD server (A) 4-1 and the EMD 
server (B) 4-2 are transferred to the portable device (X) 6-3. 

[0190] In the music contents distributing system, as described above, mainly the comprehensive management unit 
(X)315 operates to convert the encryption system for music contents to be transferred, the format nf the using condition 

30 information appended to the music contents to be transferred or the compression system of the music contents to be 
transferred, in association with the respective reproducing applications and the device drivers, to effectuate transfer 
of the music contents with the aid of the unified transfer protocol. So, the music contents downloaded by the reproducing 
application (A) 311 from the EMD server (A) 4-1 and the music contents downloaded by the reproducing application 
(B) 312 from the EMD server (B) 4-2 can be transferred to the comprehensive management unit (X)315 so that the 

35 music contents ol an artist furnished only by e.g., the music furnishing company A can be transferred to the portable 
device (X) 6-3 That is, since the present music contents distributing system converts the encryption system of music 
contents, format of the using condition information and the compression system for the music contents into the unified 
transfer protocol, the music contents of variable systems, stored in the hard disc of the personal computer 1 , can be 
reproduced by the comprehensive management unit (X)315 or the portable device (X) 6-3. In particular, since the music 

■to contents distributing system converts the encryption system and the using condition information at the time of transfer, 
the degree of freedom in handling the music contents can be enhanced while protection of the copyrights of the music 
contents is assured. 

[0191] That is, in the music contents distributing system, at least the encryption system and the using condition 
information are converted between reproducing applications adapted for reproducing or controlling the music contents 
4 $ to transfer the music contents and the using condition information. By so doing, the music contents distributing system 
is able to move the music contents stored in e.g , the hard disc 21 in the personal computer 1 , even if there are plural 
reproducing applications, thus enabling unified management of tie music contents. Moreover, since (he using condition 
information is transferred along with the music contents, there is no risk of the using conditions overlapping with sole 
music contents thus assuring more reliable protection of the music contents. 

50 

(3) Using Condition Information 

(Explanation of Routinely Used Using Condition Information) 

55 [0192] A typical format of the using condition information used in the reproducing application (A) 311 is now explained. 
[01 93] In the reproducing application (A) 311 , the using condition information, represented by a tabulated form shown 
for example, in Fig.3a, is used. 

[0194] In the left and right columns of the Table are stated, in the columnar direction, the policies of the using con- 
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ditions and specified values of the policies, respectively. For example, the possible replay date (from), replay end date 
(to) or the cost per replay (pay/play) are stated as policies The using condition information is distributed from the EMD 
server (A) 4-1 as the information is appended to each music contents, as shown in Fig.9B. The reproducing application 
(A) 311 controls the music contents in accordance with the stated policies and the corresponding values. For example, 

s assume that the possible replay date (from) is October 25. 1999. replay end date (to) is November 24, 1 999 and the 
cost per replay (pay/play) is yes/10 yen. In such case, the music contents can be reproduced as from October 25, 1999 
and reproduction thereof before this data is inhibited even if a replay command is issued from the user. The music 
contents also can be reproduced until November 24 199 ,: > such that the music contents are erased as from this date. 
The music contents also are set so that 10 yen is assessed per replay . The number of times of reproduction by the 

10 user is stored as the separate log information which is upionded to the EMD server (A) 4-1 to assess the user who 
heard or viewed by an amount corresponding tc the njmoci ol limes the music contents are heard or viewed. 

(Explanation of the Using Condition Information as Used by the Comprehensive management unit (X)315) 

'5 [0195] The using condition information, as used by the comprehensive management unit (X)315, is now explained. 
The using condition information, now explained, is appended to the music contents downloaded from the EMD server 
(X) 4-3, and is used when the comprehensive management u nit ( X j 3 1 5 manages control of the music contents. More- 
over, the using condition information is used as a unilicd format when reciprocally transferring music contents between 
the reproducing application (A) 311 and the comprehensive management unil (X)315 or between the reproducing 

20 application (A) 311 and the comprehensive management unit (X)315 This using condition information is referred to 
below as the unified using condition information 

[0196] The unified using condition information is made up of an index file 331, an automaton file 332, a parameter 
file 333 and a hysteresis file 334, as shown in Fig 4. These files are stated in an XML (extensible Markup Language) 
language. 

25 [0197] In the index file 331 is stated e.g., the reference information of each file. 

[0198] To the automaton file 332 are appended an automaton staling portion 341, stating the using conditions by 
automaton, an authentication code by contents keys (MAC: Message Authentication Code) 342, a signature by a 
contents purveyor (Sig) 343 and a certificate for verifying the signature (Cert) 344, as shown in Fig. 11 . The contents 
key is denoted KC, whilst a private key and a public key of the contents purveyor who prepared the contents are 

30 denoted K" 1 E and K 1 E , respectively. 

[0199] The automaton stating portion 341 describes the operating state of music contents by an Extended State 
Machine stated in tuple sequence. 

[0200] With a set of the operating states of the current music contents Q and with a set of input symbols representing 
the events of the music contents Z, the automaton stating portion 341 expresses a set O' ol the operating states of the 
35 music contents following status transition as follows: 

Q' - {did - 5(q.«)lqQ, ocQ, 6: Q • I ->Q] 

40 [0201] As shown in this equation, the set Q' of the operating states is expressed as d. The d is defined by a function 
5 having variables q,a The q indicates one operating stale of the set Q of the operating states of the music contents. 
The a indicates an event of the set of events S. The function S is a map of a power set of Q and I to Q. 
[0202] Based on the above Q, I, and Q', each tuple is expressed by 

{<q, a, d>lq, deQ, «GI). 

Note that <q, a, d> indicates an example of permutation and combination of q, «, d 

[0203] In £, events such as replay (play), copy (copy), amount (pay Y), possible play start date and time (from YMD), 
so play end date and time (to YMD), number of usable days (in Ddays), or null event (e), are stated as follows. 

I = (Play, copy, pay Y, from YMD, to YMD, in Ddays, e). 

55 [0204] So, the following statement is made in automaton descriptor 341 . 

[0205] A specified statement in the automaton descriptor 341 is hereinafter explained. 

[0206] An illustrative description by a tuple-row of the automaton, representing operation transition of music contents 
shown in Fig. 12, is shown in Fig. 13. 
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[0207] This automaton performs the status transitions as now explained 

[0208] First, transition is made from an initial state qO to a state q1 and to a state q5. 

[0209] From the states q1 and q5, parallel movement occurs. 

[0210] If a payment event of a pre-set amount, such as 10 yen (pay 10) occurs in the state q1 , transition to the state 
q2 occurs. If the play event (play) occurs in the state q2, transition is made to the state q1 . That is, the present automaton 
indicates that, if the payment of 1 0 yen is made, the music contents may be reproduced only once. If a payment event 
of a pre-set amount, such as 1000 yen (a.payl 000) occurs in the state q1 , transition is again made to the status q3. 
Specifically, this automaton indicates that, if the payment of 1 00 yen is made, the music contents can be reproduced 
without regard to the number of times. If a payment event in an amount corresponding to n times the reproduction 
amount for one reproduction, such as 10 yen (paylOxn) occurs, transition is made to the status q4. If, after transition 
to the status q4, the play event (play) occurs, transition is again made to this state q4. If n play events occur in this 
state q4, transition is made to the status q1. That is, in this automaton, it is shown that, if 10xn yen is paid, the music 
contents can be reproduced n times. 

[0211] If a payment event of a pre-set amount, such as 100 yen, occurs in the state q5, transition is made to the 
state q6. If a copy event occurs in the state q6, transition is made to the state q5. If a copy event occurs in the status 
q6, transition occurs to the status q8. If a play event occurs in the state q8, transition is again made to this state q8. If 
a copy event occurs in this state q8, transition is made to the state 9. This slate q9 is a final state where no transition 
to other states occurs and no event occurs. That is. this automaton shows that, if 1 00 yen is paid, the music contents 
can be copied once to other device. Moreover, this automaton shows thai, although the music contents copied can be 
reproduced any desired number of times, reproduction is impossible if once the music contents are copied to another 
device. 

[0212] If the payment event of a pre-set amount, such as 2000 yen (a.pay2000) occurs in the state q5, transition is 
made to the state q7. If a copy event occurs in the state q7, transition is again made to this state q7. If a copy event 
occurs in the state q7, transition is made to the state q8. If a play event occurs in the state q8, transition is again made 
to this state q8. If a copy event occurs in this state q8, transition is made to the state q9. This state q9 is a final state 
where no transition to other states occurs and no event occurs. That is, this automaton shows that, if 2000 yen is paid, 
the music contents can be copied to another device a limitless number of times. Moreover, the automaton shows that, 
although the copied music contents can be reproduced any desired number of times, the music contents, copied to 
another device, can not be reproduced. 

[0213] Fig. 13 shows a tuple row statement of the automaton performing the above-described status transitions. 
[0214] It is possible for the automaton stating portion 341 to state parallel synthesis of operating states, in order to 
update the movement of music contents For example, parallel synthesis of the operations a 0 and a, may be repre- 
sented by the tuple sequence as follows: 

<q 0 , a. a 0 , q 0 > 



<q 0 , a, a v q 0 >. 

[021 5] It is also possible lo state an action accompanying the status transition in the automaton stating portion 341 . 
For example, the action is represented by tuple as follows: 

<q 0 , a, o, 1 ; action> 

[0216] This action is represented as a function employing a pre-defined variable. The variable is made up of an ID, 
a scope and an initial value. For example, with a variable n representing the purchasing price of an album (a), statement 
is such that a n: =- 1000. An example of the automaton stating portion 341 stating an action with respect to the variable 
is as shown below: 

<q 0 , pay100, q,, a n: = a.n - 100> (1) 



<q 0 , pay (a n), q 1 ,a.n: = 0> (2) 



17 




EP 1 158 417 A1 



<q 1 ,play, q 2 > 



(3) 



[0217] This example indicates that the purchasing price of a sole music contents (equation (1 )) affects the price of 
5 album purchase (equation (2)). 

[0218] The above-described automaton stating portion 341 is made up of an entry ID 345, a contents ID 346, version 
information 347, variable information 348, and a tuple sequence 349, as shown in Fig. 14. 

[0219] A specified example of the automaton stating portion 341 the description format of which has been defined 

will be described in the following. 
10 [0220] Meanwhile, the events and commands used below as the automaton descriptions are defined by a DTD 

(Document Type Definition) specified on the basis of the XML specification. For example, the reproduction (play), 

duplication (copy), pay for play (pay-for-play), pay for duplication (pay-for copy), pay for album play (pay-for-album- 

play), pay for album duplication (pay-for-album-copy), possible use start date (from), use end date (to) and a null 

operation (null) are set as events by the DTD. 
15 [0221] Fig. 16 shows an exemplary description of the automaton stating portion 341 by the XML language indicating 

that the music contents can be reproduced as from September 1 , 1 999. 

[0222] The description shown in Fig. 16 is an automaton shown in Fig. 17. The automaton is constituted by the state 
q1 as an initial state and the state q2. When the date becomes September 1 , 1999 which is a possible use start date 
(from) in the state q 1 , the state is moved to the state q2. When the reproduction event (play) is generated in the state 
20 q2, the music contents are reproduced, and the state is again moved to the state q2. In such manner, the automaton 
controls to enable reproduction of the music contents from September 1 , 1 999. 

[0223] Fig. 1 8 shows an exemplary description of the automaton stating portion 341 by the XML language indicating 
that the music contents can be reproduced until October 31 , 1 999. 

[0224] The description shown in Fig. 18 is an automaton shown in Fig. 19. The automaton is constituted by the state 
25 q1 as an initial state and the state end as an end state. When the reproduction event (play) is generated in the state 

q2, the music contents are reproduced, and the state is again moved to the state q2. When the date becomes October 

31, 1999 which is a use end date (to) in the state q2, the state is moved to the state end. In the state end, the state is 

not moved to any state, or no event is generated. In such manner, the automaton controls to enable reproduction of 

the munic contents until October 31, 1999. 
30 [0225] Fig. 20 shows an exemplary description of the automaton stating portion 341 by the XML language indicating 

that the possible reproduction time period for the music contents is from September 1 , 1999 until October 31 , 1999, 

with the number of times of possible reproduction being 16. 

[0226] The description shown in Fig. 20 is an automaton shown in Fig. 21 . The automaton is constituted by the state 
q 1 as an initial state , the state q2 and the state end as an end state. When the date becomes September 1 , 1 999 which 

35 is a possible use start date (from) in the state q1 , the state is moved to the state q2. When the reproduction event 
(play) is generated in the state q2, the music contents are reproduced, and the state is again moved to the state q2. 
When the date becomes October 31, 1999 which is a use end date (to) in the state q2, or the reproduction event is 
generated 16 times (play ■ 16), the state is moved to the state end. In the state end, the state is not moved to any 
state, or no event is generated. In such manner, the automaton controls to define the reproduction period from Sep- 

40 tember 1 , 1 999 to October 31 ; 1 999, and to define the number of reproduction to be 1 6 times. 

[0227] Fig. 22 shows an exemplary description of the automaton stating portion 341 by the XML language indicating 
that the number of times of reproduction of the music contents is to be limited to 16. 

[0228] To the parameter file 333 are appended a parameter statement portion 351 , authentication code 352 by con- 
tents key, a signature 353 by a contents purveyor, and a writ of authentication 354 verifying the signature, as shown 
43 in Fig. 23. The contents key is denoted KC, whilst the private key and the public key of the contents purveyor who 
prepared the contents are denoted K" 1 E and K 1 E , respectively. 

[0229] The parameter file 333 can be rewritten by a contents purveyor other than the contents purveyor who prepared 
the automaton file 332, for example, a secondary purveyor such as a contents retail dealer or by an intermediate 
contents distributor. To the parameter file 333 so rewritten is appended a unique entity ID 355 accorded to the purveyors 

50 or to the intermediate distributor. Meanwhile, K' c is the contents key of the secondary purveyor, with K' c = H(K C , Entity 
ID). The contents key K' c of the secondary purveyor is formulated from the contents key K c of the primary purveyor. 
The primary and secondary purveyors are distinguished from each other by the writs of authentication. 
[0230] The parameter file 333 is verified by MAC if the contents key is already to hand. If the contents key is not 
available for reasons pertinent to safety, the parameter file 333 is verified by signatures and instruments. 

55 [0231] With the primary and secondary contents purveyors S and A, and with the terminal B, the protocol verified by 
MAC is as follows. S->A indicates transmission from S to A, S->B indicates transmission from S to B, and A->B indicates 
transmission from A to B. ID A indicates an ID of the device A. 
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S^A: K' C = H(K C ,ID A ) 



S->B: X = E KS (K C )1 



A->B: ID A , Parameters, M = MACK' C (Parameters) 



B: M = MAC' K , C (Parameters)? 

[0232] This parameter statement portion 351 states coefficients of a function for changing the values stated in the 
automaton stating portion 341 of the automaton file 332. For example, in the example shown in Fig 13, there are 
occasions wherein the price of the music contents becomes a function, as shown below: 

<q 0 , pay (^(10)), q t > 



<q v pay (f 2 (10)xn), q 2 > 
[0233] In this case ; the above functions f, and f 2 are defined, for example, as follows. 

f 1 (n) = 0.9n 



f 2 (n) = 90^0.1n. 

[0234] By defining the functions as above, it is possible for the primary purveyor to set a default price value and for 
the second purveyor to rewrite the parameter file 333 to change the price. 

[0235] The above-described parameter statement portion 351 is made up of an entry ID 356, contents ID 357 and 
the coefficients information 358, as shown in Fig. 25. 

[0236] The hysteresis file 334 is a file for stating the trajectory of the operation of the music contents, operated based 
on the contents of description, in the automaton stating portion 341. The status and the variable in the tuple of the 
automaton stating portion 341 is recorded. For example, if reproduction is carried out twice in the example of Fig. 13, 

%■ 9i> 

results, so that the trajectory of the following operation: 

<pay10, play, pay10, play> 

is obtained. 

[0237] If this is summed and uploaded in e.g., the comprehensive management unit (X)15, it is possible to compute 
the amount payable by the user. 

[0238] In the music contents distributing system 1 , in which the unified using condition information, representing the 
using condition by an automaton in which the policy itself and its concrete value are programmed, is used, it is possible 
to elevate the degree of freedom in the description of the contents using conditions. 

(4) Re-storage and Re-downloading of Destructed Music Contents 

[0239] The backup of music contents by the comprehensive management unit (X)31 5 is now explained. 

[0240] First, the key management method of the comprehensive management unit (X)31 5 is explained by referring 

to Fig.26. 
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[0241] The comprehensive management unit (X)315 stores the music contents C1 , C2, C3, ... Cn in the hard disc 
21 in the personal computer 3. The comprehensive management unit (X)31 5 also stores the contents keys Kc1 , Kc2, 
Kc3, — , Ken, associated with the music contents C1 , C2, C3, — Cn, respectively. The contents keys Kc are in a one- 
for-one correspondence to the music contents C. To the music contents C1 , C2, C3, — Cn are appended the contents 
IDs tor identification. These contents IDs are termed CID1, CID2, CID3, — , CIDn. 

[0242] The music contents C1 , C2, C3, — Cn are encrypted by the contents keys Kc1 , Kc2, Kc3, -, Ken and, in this 
state, are recorded in the hard disc 21 of the personal computer 3. E(K, C) denotes that the contents C have been 
encrypted with the key K. Usually, the contents IDs are recorded in a header of the music contents C and encrypted 
along with the music contents C, or the MAC is appended to the music contents C, such that the contents IDs are not 
separable from the main body portion of the music contents. 

[0243] The contents keys Kc1 , Kc2, Kc3, — , Ken are encrypted by the storage keys KS and are recorded in the state 
of E(SK : Kc1), E(SK, Kc2), E(SK, Kc3), -, E(SK, Ken) in the hard disc 21 of the personal computer 1. This storage 
keys Ks exhibits so-called resistance to short wavelength and is saved in a recording area that cannot be referenced 
by an ordinary user. 

[0244] If, in the comprehensive management unit (X)315, where the key management is performed as described 
above, the music contents C1 , for example, is to be reproduced, the contents key Kc1 is decrypted, using the storage 
key KS, and subsequently the music contents C1 is decrypted, using this contents key Kc1 . In this manner, the com- 
prehensive management unit (X)315 is able to reproduce the music contents C1 . 

[0245] l(, in the comprehensive management unit (X)315, where the key management is performed as described 
above, the music contents C1 is to be moved from the hard disc 21 to the portable device (X) 6-3, reciprocal authen- 
tication is performed with the portable device (X) 6-3 On completion of the authentication, the contents key Kc1 is 
decrypted by the session key and the encrypted contents key Kc1 as well as the encrypted music contents C1 is 
transferred to the portable device (X) 6-3. The contents key Kc1 and the encrypted music contents C1 are both trans- 
ferred to the portable device (X) 6-3. The contents key Kc1 and the music contents C1 are both erased from the hard 
disc 21 . By so doing, the comprehensive management unit (X)315is able to move the music contents C1 to the portable 
device (X) 6-3. 

[0246] The method of regenerating the music contents as becomes necessary when the music contents or the con- 
tents key cease to be reproducible from the hard disc 21 due to, for example, destruction of the hard disc 21 , is here- 
inafter explained. 

[0247] Usually, the comprehensive management unit (X)315 saves the backup data of the encrypted music contents 
C and the contents key Kc in the hard disc 21 . 

[0248] Also, usually, the comprehensive management unit (X)315 is supervising the purchase records of the music 
contents downloaded form the EMD server (X) 4-3 and the list of the contents ID of the totality of the music contents 
stored in the hard disc 21 as use log information. This log information is to be updated at the time of controlling of the 
music contents as when the music contents is downloaded from the EMD server (X) 4-3 or moved to the portable 
device (X) 6-3. The comprehensive management unit (X)315 uploads the log information to the EMD server (X) 4-3 
periodically or after accessing. 

[0249] If the music contents C or the contents key Kc stored in the hard disc 21 of the comprehensive management 
unit (X)315 are destroyed, the following processing is executed. 

[0250] If the music contents C or the contents key Kc are destroyed, the comprehensive management unit (X)315 
first accesses the EMD server (X) 4-3 to perform user authentication. 

[0251] The EMD server (X) 4-3 then refers to the use log information of the comprehensive management unit (X) 
315, from the user ID of the authorized user, to generate an integrity check value (ICV). This ICV is generated, based 
on the CID, as the contents ID of the music contents C stated in the use log information and on the storage key KS of 
the comprehensive management unit (X)315, in accordance with: 

ICV = H(SK, CIDIIICID2II -IICIDn) 

where H(K, Data) is a uni-directional hash function and has its value changed with the key K. 
[0252] The EMD server (X) 4-3 then transmits the generated integrity check value ICV to the comprehensive man- 
agement unit (X)315. 

[0253] If the music contents C or the contents key Kc are backed up, the comprehensive management unit (X)315 
re-stores the backup data to save the music contents C orthe contents key Kc in the hard disc 21 . If the music contents 
C or the contents key Kc are backed up, the music contents C or the contents key Kc destructed is to be re-distributed 
from the EMD server (X) 4-3. At this time, the EMD server (X) 4-3 references to the purchase hysteresis of the user, 
and refrains from assessment if the contents have once been purchased. 

[0254] The comprehensive management unit (X)315 performs the above processing to re-construct the music con- 
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tents C or the contents key Kc destroyed. 

[0255] If the music contents C or the contents key Kc regenerated are to be reproduced or controlled, the compre- 
hensive management unit (X)31 5 checks the CID of the music contents by the integrity check value ICV. By checking 
the music contents C orthe contents key Kc reconstructed using the integrity check value ICV, a user with a malignant 
5 intention, who memorized E (Kci, Ci) as encrypted music contents Ci and re-stored the music contents, in case the 
music contents Ci is moved to the portable device (X) 6-3 and is erased from the hard disc 21 , is unable to reproduce 
or move the data by way of control. 

[0256] If it is not the music contents C or the contents key Kc but the storage key KS that has been destroyed, the 
comprehensive management unit (X)315 is re-installed. Even in such case, re-storage or re-downloading is feasible 
io if user registration is made in the EMD server (X) 4-3 and the log information is uploaded. 

[0257] In the music contents distributing system 1, as described above, music contents can be re-constructed, under 
protection of the copyright, even if the music contents have been destroyed by hard disc crushing. If, for example, the 
music contents have been purchased correctly, it can be re-constructed free of charge. 

is (5) Method for Allotting Master Key and Authentication Key of the Comprehensive Management Unit (X) 

[0258] Between the comprehensive management unit (X)31 5 and the portable device (X) 6-3, there occurs reciprocal 
authentication using the ID and an authentication key (MG-ID/IK) proper to the portable device (X) 6-3 and a master 
key (OMG-MK) proper to the comprehensive management unil (X)315. 

20 [0259] If there has occurred reciprocal authentication between the comprehensive management unit (X)315 and the 
portable device (X) 6-3, it becomes possible for the comprehensive management unit (X)315 to send music contents 
from the comprehensive management unit (X)315 to the portable device (X) 6-3 or to return the music contents from 
the portable device (X) 6-3 to the comprehensive management unit (X)315. Meanwhile, the comprehensive manage- 
ment unit (X)31 5 holds the encrypted music contents in the hard disc 21 of the perspective view 3, whilst the portable 

25 device (X) 6-3 holds the encrypted music contents in the internal recording medium, such as a memory card. So, if the 
music contents are sent from the comprehensive management unit (X)31 5 to Ihe portable device (X) 6-3, music contents 
on the hard disc 21 on the personal computer 1 are transferred to the memory card loaded on the portable device 10. 
On the other hand, if music contents are to be sent from the portable device (X) 6-3 to the comprehensive management 
unit (X)31 5, the music contents on the memory card loaded on the portable device (X) 6-3 are transferred to the hard 

30 disc 21 on the personal computer 1 . 

[0260] The portable device (X) 6-3 holds ID information (MG-ID), authentication keys (MG-IK) for plural generations 
and master keys (OMG-MK) for plural generations from the outset. The portable device (X) 6-3 is not furnished with 
these keys or the information from outside. The portable device (X) 6-3 updates the generation of the authentication 
keys (MG-IK) and the master keys (OMG-MK). The portable device (X) 6-3 effectuates reciprocal authentication not 

35 by the authentication key or master key of the old generation, but by those of the new generation. In the following it is 
assumed that the portable device (X) 6-3 is holding the authentication keys (MG-ID) and the master keys (OMG-MK) 
for 100 generations of from zeroth to 100th generations. The authentication key for the ith generation is denoted the 
(MG-IK[i]) and the master key for the ith generation is denoted the (OMG-MK[iJ). 

[0261] The comprehensive management unit (X)315, holding the master keys (OMG-MK), is able to transfer the 
40 music contents from e.g., a compact disc for audio into the personal computer 1 for storage therein. On the other hand, 
the comprehensive management unit (X)315, holding the master keys (OMG-MK), is able to download the music con- 
tents from the EMD server (X) 4-3 for storage in the personal computer 1 . 

[0262] It is noted that, in the comprehensive management unit (X)315, the master key (OMG-MK), that is able to 
transfer the music contents from the compact disc but is unable to download music contents from the EMD server (X) 

45 4-3, differs from the master key (OMG-MK), that is able to transfer music contents both from the CD and from the EMD 
server (X) 4-3. In the following, the key that is able to transfer the music contents from the compact disc but is unable 
to download music contents from the EMD server (X) 4-3 is termed a key dedicated to ripping and the key that is able 
to transfer music contents both from the CD and the EMD server (X) 4-3 is termed an EMD key 
[0263] In the present embodiment, the master key for the zeroth generation (OMG-MK[0]) is the key dedicated to 

50 ripping, whilst the master keys (OMG-MK[1 to 99]) are EMD keys. 

[0264] The sequence for processing employing the key dedicated to ripping is explained. 

[0265] If the comprehensive management unit (X)315 is to be installed from the CD-ROM, the portable device (X) 
6-3 and a floppy disc 52, for example, are sold as a set with a CD-ROM 51 having installed therein an installing software 
of the comprehensive management unit (X)31 5, as shown in Fig. 27. In the floppy disc 52 are stored the ID information 
55 (MG-ID) for the portable device (X) 6-3, the authentication key for the zeroth generation (MG-IK[0]) and the master 
key for the zeroth generation (OMG-MK[0J) 

[0266] For enabling the sold portable device (X) 6-3 etc., to be used, the CD-ROM 361 is first loaded on the personal 
computer 1 (step S11). The comprehensive management unit (X)315 then is installed from the CD-ROM 361 onto the 
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personal computer 1. The comprehensive management unit (X)315 then is installed in the hard disc of the personal 
computer 1 (step S13). The ID information (MG-ID) of the portable device (X) 6-3, stored in the floppy disc 362, the 
authentication key forthe zeroth generation (MG-IK[0]) and the master key for the zeroth generation (OMG-MK[0]) are 
then saved in the personal computer 1 (step S14). 
5 [0267] This enables the music contents furnished by e.g., amusic CD 363 to be stored in the hard disc of the personal 
computer 1 (step St 5). Meanwhile, since the master key for the zeroth generation (OMG-MK[0]) is a key dedicated to 
ripping, no music contents can be downloaded from the EMD server (X) 4-3. 

[0268] The portable device (X) 6-3 holds authentication keys and master keys for 100 generations to cope with 
generation updating. In the initial setting, the generation is the zeroth generation. So, reciprocal authentication between 
'0 the comprehensive management unit (X)31 5 holding the authentication key of the zeroth generation and the master 
key and the portable device (X) 6-3 becomes feasible. Thus, it becomes possible to store the music contents furnished 
by the music CD 363 etc in the memory card of the portable device (X) 6-3 (step S16). 

[0269] On the other hand, if the comprehensive management unit (X)31 5 is furnished through the network, the ad- 
dress, user ID and the password etc , on the EMD registration server 3 on the Internet, along with the comprehensive 

'5 management unit (X)315, as shown in Fig. 28. 

[0270] If the portable device (X) 6-3 etc., as sold, is to be rendered usable, the EMD registration server 3 on the 
network is accessed, using the user ID and the password (step S21). The EMD registration server 3 then authenticates 
the user ID and the password (step S22). If there is no problem in the authentication, the EMD registration server 3 
transmits the installing software of the comprehensive management unit (X)31 5, ID information (MG-ID) of the portable 

20 device (X) 6-3, the authentication key of the zeroth generation (MG-IKfO]) and the master key of the zeroth generation 
(OMG-MK[0|) to the personal computer 1 (step S23). The personal computer 1 then boots the installing software of 
the comprehensive management unit (X)315 to install the comprehensive management unit (X)315, while saving the 
ID information (MG-ID) of the portable device (X) 6-3, the authentication key of the zeroth generation (MG-IK[0]) and 
the master key of the zeroth generation (OMG-MK[0j) in the hard disc 21 (step S24). This stores the comprehensive 

25 management unit (X)315 in the hard disc (step S25). 

[0271] This enables the comprehensive management unit (X)315, furnished by e.g., the music CD 363, to be stored 
in the hard disc 21 of the personal computer 1 (step S26), Meanwhile, since the master key of the zeroth generation 
(OMG-MK[0]) is a key dedicated to ripping, the music contents cannot be downloaded from the EMD server (X) 4-3. 
[0272] The portable device (X) 6-3 holds the authentication keys and master keys for 1 00 generations, in order to 

30 cope with the generation innovation. In the initial state, the generation is set to the zeroth generation. So, the reciprocal 
authentication between the comprehensive management unit (X)315 holding the authentication key and the master 
key of the zeroth generation and the portable device (X) 6-3 becomes possible. Therefore, the music contents furnished 
by the music CD 363 etc., can be stored in the memory card of the portable device (X) 6-3. 

[0273] In addition to the method shown in Figs.27 and 28, such a method may also be used in which the compre- 
ss hensive management unit (X)315 and the master key of the zeroth generation (OMG-MK[0]) dedicated to ripping is 
stored in the CD-ROM 361 and in which the authentication ID with respect to the portable device (X) 6-3 and the 
authentication key for the zeroth generation (MG-ID/IK) are furnished over the network. 

[0274] The sequence of operations for updating the key dedicated 1o ripping to an EMD key to enable the handling 
of music contents downloaded from the EMD server (X) 4-3 is hereinafter explained. 

40 [0275] The comprehensive management unit (X)315 is furnished via a removable medium, such as a CD-ROM, or 
over a network, such as Internet, by the sequence of operations shown in Figs.27 and 28, and is installed in the hard 
disc 21 in the personal computer 1 . At this time, the comprehensive management unit (X)315 is holding the master 
key of the zeroth generation (OMG-MK[0]) dedicated to ripping and the authentication key for the zeroth generation 
(MG-ID/IK[0]), with the key ot the portable device (X) 6-3 being in the default generation. 

^5 [0276] First, the personal computer 1 accesses th EMD registration setver 3 on the network, using the user ID and 
the password (step S31), as shown in Fig.29. The EMD registration server 3 then authenticates the user ID and the 
password (step S32). If there is no problem in authentication, the EMD registration server3 registers the ID information 
of the personal computer 1 (OMG-ID) to generate an open key (OMG-PK), secret key (OMG-SK) and the writ of au- 
thentication (Cert [PK]) of the open key for the comprehensive management unit (X)315 to connect to the EMD server 

so (X) 4-3 (step S33). The EMD registration server 3 then transmits the generated open key (OMG-PK), secret key (OMG- 
SK) and the writ of authentication (Cert [PK]) to the personal computer 1 (step S34). 

[0277] The EMD registration server 3 then transmits the ID information of the portable device (X) 6-3 (MG-ID), au- 
thentication key of the ith generation (MG-IK[i]) and the master key of the ith generation (OMG-MK[i|) to the personal 
computer 1 (step S35). The EMD registration server 3 then updates the received keys etc., based on the received ID 
55 information (MG-ID) , authentication key of the ith generation (MG-IK[i]) and the master key of the ith generation (OMG- 
MK[i]) to the ith generation (step S36). The comprehensive management unit (X)31 5 then executes authentication with 
the portable device (X) 6-3 (step S37) On authentication the portable device (X) 6-3 updates the generation of the 
own key to the ith generation (step S38). 
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[0278] This enables the comprehensive management unit (X)31 5 to store music contents furnished by the music CD 

363 to be stored in the hard disc of the personal computer 1 as well as to store the music contents downloaded from 

the EMD server (X) 4-3 in the hard disc 21 of the personal computer 1 (step S39). 

[0279] The sequence of operations of generation innovation of e.g., the EMD key is explained. 

[0280] The comprehensive management unit (X)315 is holding the master key of the ith generation (OMG-MK[i]), ID 

for au and the authentication key of the zeroth generation (MG-IKffl), with the generation of the portable device (X) 6-3 

being also the ith generation. 

[0281] First, as shown in Fig. 30, if the personal computer 1 accesses the EMD registration server 3 to do some 
processing, the EMD registration server 3 authenticates the ID of the comprehensive management unit (X)315 to 
transmit the authentication key of the (i+k)th generation (MG-IK[i+k]) and the master key ol the (i+k)th generation 
(OMG-MK[i+k]) to the personal computer 1 (step S41 ). The comprehensive management unit (X)315 of the personal 
computer 1 updates the received authentication key and the master hey to the (i+k)th generation (step S42). The 
comprehensive management unit (X)315 then authenticates the portable device (X) 6-3 (step S43). When authenti- 
cated, the portable device (X) 6-3 updates the generation of the own key from the ith generation to the (i+k)th generation 
(step S44). 

[0282] On the other hand, as shown in Fig. 31 , if the generation of the authentication key etc., used by the portable 
device (X) 6-3, is the (i+k)th generation, and that of the authentication key etc., held by the comprehensive management 
unit (X)315 is the ith generation, the authentication between the portable device (X) 6-3 and comprehensive manage- 
ment unil (X)315 results in failure, even if such authentication is altempled. (Step S51). If the authentication results in 
failure, the comprehensive management unit (X)315 requests a key to the EMD registration server 3 (step S52). If 
there is a key request, the EMD registration server 3 authenticates the ID of the comprehensive management unit (X) 
315 to transmit the authentication key of the (i+k)th generation (MG-IK[i-t-k)) and the master key of the (i+k)th generation 
(OMG-MK[i+k]) (step S53). The comprehensive management unit (X)315 then updates the received authentication 
key and master key to the (i-i-k)th generation (step S54). The comprehensive management unit (X)315 then authenti- 
cates the portable device (X) 6-3 (step S55). 

[0283] This enables the comprehensive management unit (X)31 5 to store the music contents furnished by the music 
CD 363 etc., to be stored in the hard disc 21 in the personal computer 1 and to store the music contents downloaded 
from the EMD server (X) 4-3 to be stored in the hard disc 21 in the personal computer 1 (step S38). 
[0284] In the above-described music contents distributing system 1, the master and authentication keys, used by 
the comprehensive management unit (X)31 5 and the portable device (X) 6-3, are classed into keys dedicated to ripping 
and those connected lo the server, and the keys connected to the server are downloaded over the network. The result 
is that, in the music contents distributing system 1 , safety in the music contents distributed from the server is improved, 
such that, if the keys dedicated to ripping are broken, the music contents downloaded from the server cannot be 
destroyed. 

[0285] In the music contents distributing system 1 , the master and authentication keys, used by the comprehensive 
management unit (X)315 and the portable device (X) 6-3, are used subject to generation innovation. Moreover, the 
comprehensive management unit (X)31 5 is fed with the master and authentication keys overthe network for generation 
innovation, thus raising safety of the music contents. 

Industrial Applicability 

[0286] In the contents purveying system and method, according lo the present invention, if the reproduction program 
handles only contents data stored in the external storage medium saving ol the contents data stored in the external 
storage medium and authentication with the portable reproducing device nrc performed using the first authentication 
key and the first master key. If the reproduction program handles contents data furnished over a network, the saving 
of the contents data stored in the external storage medium and the authentication with the portable reproducing device 
are performed using the first authentication key and the first master key Trio second authentication key and the second 
master key are furnished over the network to the reproduction program, and are keys different from the first authenti- 
cation key an the first master key, respectively. By so doing, the contents data distributed overthe network can be 
improved in safety. 



Claims 

1 . A contents purveying system including a data processor having a reproduction program for reproducing contents 
data, a portable reproducing device for storing the contents data furnished from said data processor on a recording 
medium for reproduction and a contents server for distributing the contents data over a network to said data proc- 
essor, wherein said data processor is configured so that 
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a first master key and a first authentication key are furnished to said reproduction program after installing said 
reproduction program, the contents data stored in an external storage medium connected to the data processor 
are acquired using said first master key for storage., said reproduction program executing authentication with 
respect to said potable reproducing device using the so-furnished first authentication key and first master key, 
said data processor also being configured so that, when transmission/reception of the contents data distributed 
from said contents server to said reproduction program is made with said portable reproducing device, a sec- 
ond master key different from said first master key and a second authentication key different from the first 
authentication key are furnished over the network, the contents data furnished from said contents server are 
acquired using the so-furnished second master key for storage, and authentication with respect to the portable 
reproducing device is made using the so-furnished second authentication key and the second master key to 
effect transmission/reception of the contents data. 

The contents purveying system according to claim 1 wherein said portable reproducing device holds first to i'th 
authentication keys updated in generation from the first to the i'th generation, i being an integer equal to 2 or larger, 
and first to i'th master keys updated in generation from the first to the i'th generation, i being an integer equal to 2 
or larger; 

said reproducing program being furnished over the network with second to i'th authentication keys updated in 
generation from the second to the i'th generation, i being an integer equal to 2 or larger, and second to i'th 
master keys updated in generation from the second to the i'th generation , i being an integer equal to 2 or larger; 
said portable reproducing device performing reciprocal authentication with said reproduction program using 
the authentication key of the same generation. 

The contents purveying system according to claim 2 wherein if said portable reproducing device performing recip- 
rocal authentication with said reproduction program is using an authentication key and a master key of a generation 
older than the generation used by said reproduction program, the portable reproducing device updates the own 
authentication key and master key until the generation used by said reproduction program. 

The contents purveying system according to claim 2 wherein if said reproduction program performing reciprocal 
authentication with said portable reproducing device is using an authentication key and a master key of a generation 
older than that used by said portable reproducing device, said reproduction program asks said contents server for 
a key to update the own authentication key and the own master key up to the generation used by said portable 
reproducing device. 

The contents purveying system according to claim 2 wherein, if accessed by said contents server, said contents 
server furnishes an authentication key and a master key of a generation later than that of the authentication key 
used by said reproduction program to update the generation of the authentication key used by said reproduction 
program. 

A contents purveying method including a data processor having a reproduction program for reproducing contents 
data, a portable reproducing device for storing the contents data furnished from said data processor on a recording 
medium for reproduction and a contents server for distributing the contents data over a network to said data proc- 
essor, wherein 

a first master key and a first authentication key are furnished to said reproduction program after installing said 
reproduction program , the contents data stored in an external storage medium connected to the data processor 
are acquired using said first master key for storage, said reproduction program executing authentication with 
respect to said potable reproducing device using the so-furnished first authentication key and first master key, 
and wherein 

when transmission/reception of the contents data distributed from said contents server to said reproduction 
program is made with said portable reproducing device, a second master key different from said first master 
key and a second authentication key different from the first authentication key are furnished over the network, 
the contents data furnished from said contents server are acquired using the so-furnished second master key 
for storage, and authentication with respect to the portable reproducing device is made using the so-furnished 
second authentication key and the second master key to effect transmission>reception of the contents data. 

The contents purveying method according to claim 6 wherein said portable reproducing device holds first to i'th 
authentication keys updated in generation from the first to the i'th generation, i being an integer equal to 2 or larger, 
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and first to i'th master keys updated in generation from the first to the i'th generation, i being an integer equal to 2 

said reproducing program being furnished over the network with second to i'th authentication keys updated in 
generation from the second to the i'th generation, i being an integer equal to 2 or larger, and second to i'th 
master keys updated in generation from the second to the i'th generation, i being an integer equal to 2 or larger; 
said portable reproducing device performing reciprocal authentication with said reproduction program using 
the authentication key of the same generation. 

8. The contents purveying method according to claim 7 wherein if said portable reproducing device performing re- 
ciprocal authentication with said reproduction program is using an authentication key and a master key of a gen- 
eration older than the generation used by said reproduction program, the portable reproducing device updates the 
own authentication key and the own master key up to the generation used by said reproduction program. 

9. The contents purveying method according to claim 7 wherein it said reproduction program performing reciprocal 
authentication with said portable reproducing device is using an authentication key and a master key of a generation 
older than that used by said portable reproducing device, said reproduction program asks said contents server for 
a key to update the own authentication key and the own master key up to the generation used. by said portable 
reproducing device. 

10. The contents purveying method according to claim 7 wherein, if accessed by said contents server, said contents 
server furnishes an authentication key and a master key of a generation later than that of the authentication key 
used by said reproduction program to update the generation of the authentication key used by said reproduction 
program. 



Amended claims under Art. 19.1 PCT 

1 . A contents purveying system including a data processor having a reproduction program for reproducing contents 
data, a portable reproducing device for storing the contents data furnished from said data processor on a recording 
medium for reproduction and a contents server for distributing the contents data over a network lo said data proc- 
essor, wherein said data processor is configured so that 

a first master key and a first authentication key are furnished to said reproduction program after installing said 
reproduction program, the contents data stored in an external storage medium connected to the data processor 
are acquired using said first master key for storage, said reproduction program executing authentication with 
respect to said potable reproducing device using the so-furnished first authentication key and first master key, 
said data processor also being configured so that, when transmission/reception of the contents data distributed 
from said contents server to said reproduction program is made with said portable reproducing device, a sec- 
ond master key different from said first master key and a second authentication key different from the first 
authentication key are furnished over the network, the contents data furnished from said contents server are 
acquired using the so-furnished second master key for storage, and authentication with respect to the portable 
reproducing device is made using the so-furnished second authentication key and the second master key to 
effect transmission/reception of the contents data. 

2. The contents purveying system according to claim 1 wherein said portable reproducing device holds first to i'th 
authentication keys updated in generation from the first to the i'th generation, i being an integer equal to 2 or larger, 
and first to i'th master keys updated in generation from the first to the i'th generation, i being an integer equal to 2 

' said reproducing program being furnished over the network with second to i'th authentication keys updated in 
generation from the second to the i'th generation, i being an integer equal to 2 or larger, and second to i'th 
master keys updated in generation from the second to the i'th generation, i being an integer equal to 2 or larger; 
said portable reproducing device performing reciprocal authentication with said reproduction program using 
the authentication key of the same generation. 

3. The contents purveying system according to claim 2 wherein if said portable reproducing device performing 
reciprocal authentication with said reproduction program is using an authentication key and a master key of a 
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generation older than the generation used by said reproduction program, the portable reproducing device updates 
the own authentication key and master key until the generation used by said reproduction program. 

4. The contents purveying system according to claim 2 wherein if said reproduction program performing reciprocal 
5 authentication with said portable reproducing device is using an authentication key and a master key of a generation 

older than that used by said portable reproducing device, said reproduction program asks said contents server for 
a key to update the own authentication key and the own master key up to the generation used by said portable 
reproducing device. 

10 5. The contents purveying system according to claim 2 wherein, if accessed by said contents server, said contents 

server furnishes an authentication key and a master key of a generation later than that of the authentication key 
used by said reproduction program to update the generation of the authentication key used by said reproduction 
program. 

'5 6. A contents purveying method including a data processor having a reproduction program for reproducing contents 

data, a portable reproducing device for storing the contents data furnished from said data processor on a recording 
medium for reproduction and a contents server for distributing the contents data over a network to said data proc- 
essor, wherein 

20 a first master key and a first authentication key aie furnished to said reproduction program after installing said 

reproduction program, the contents data stored in an external storage medium connected to the data processor 
are acquired using said first master key for storage, said reproduction program executing authentication with 
respect to said potable reproducing device using the so-furnished first authentication key and first master key, 
and wherein 

25 when transmission/reception of the contents data distributed from said contents server to said reproduction 

program is made with said portable reproducing device, a second master key different from said first master 
key and a second authentication key different from the first authentication key are furnished over the network, 
the contents data furnished from said contents server are acquired using the so-furnished second master key 
for storage, and authentication with respect to the portable reproducing device is made using the so-fumished 

30 second authentication key and the second master key to effect transmission/reception of the contents data. 

7. The contents purveying method according to claim 6 wherein said portable reproducing device holds first to i'th 
authentication keys updated in generation from the first to the i'th generation, i being an integer equal to 2 or larger, 
and first to i'th master keys updated in generation from the first to the i'th generation, i being an integer equal to 2 

35 or larger; 

said reproducing program being furnished over the network with second to i'th authentication keys updated in 
generation from the second to the i'th generation, i being an integer equal to 2 or larger, and second to i'th 
master keys updated in generation from the second to the i'th generation, i being an integer equal to 2 or larger; 
40 said portable reproducing device performing reciprocal authentication with said reproduction program using 

the authentication key of the same generation. 

8. The contents purveying method according to claim 7 wherein il said portable reproducing device performing 
reciprocal authentication with said reproduction program is using an authentication key and a master key of a 

45 generation older than the generation used by said reproduction pr ogram the portable reproducing device updates 

the own authentication key and the own master key up to the generation used by said reproduction program. 

9. The contents purveying method according to claim 7 wherein if said reproduction program performing reciprocal 
authentication with said portable reproducing device is using an authentication key and a master key of a generation 

so older than that used by said portable reproducing device, said reproduction program asks said contents server for 

a key to update the own authentication key and the own master key up to the generation used by said portable 
reproducing device. 

10. The contents purveying method according to claim 7 wherein, if accessed by said contents server, said contents 
55 server furnishes an authentication key and a master key of a generation later than that of the authentication key 

used by said reproduction program to update the generation of the authentication key used by said reproduction 
program. 
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11. (Added) A method for furnishing key data to a data processing apparatus, wherein 

a first key is furnished to said data processing apparatus on which a contents reproducing program has been 
installed; 

said first key data being used for acquiring contents data stored in an external recording medium for storage 
in said data processing apparatus, said first key data also being used in authentication for transmission/re- 
ception of said contents data with a portable reproducing apparatus connected to said data processing appa- 
ratus; 

if said portable reproducing apparatus and the program reproducing program from said data processing ap- 
paratus effects transmission/reception of contents data distributed from said contents server, 
second key data different from said first key data is furnished over a network: and wherein 
said second key data is used for acquiring contents data furnished from said contents server for storage in 
said data processing apparatus, said second key data also being used for authentication of said data process- 
ing apparatus andsaid portable reproducing apparatus in orderto effect transmission/reception of the contents 
data from said contents server. 

12. (Added) The method for furnishing key data according to claim 11 wherein the ID information of said portable 
reproducing apparatus and key data of an ith generation are transmitted to said data processing apparatus and 
wherein the generation of key data of said portable reproducing apparatus is updated based on the ID information 
of said portable reproducing apparatus. 

13. (Added) The method forfurnishing key data according to claim 11 wherein the said portable reproducing ap- 
paratus holds the first to ith key data updated n generation from the first generation to the ith generation , where 
i is an integer not smaller than 2; and wherein 

second to ith key data, updated in generation from the second to the ith generation, where i is an integer not 
smaller than 2 are furnished to said contents reproducing program over a network; whereby 
said portable reproducing apparatus and the contents reproducing program performs authentication using an 
authentication key of the same generation 

14. (Added) The method for furnishing key data according to claim 1 1 wherein, when accessing is made from said 
contents reproducing program, key data of a generation newer than the generation of the key data used by said 
contents reproducing program is furnished to said contents reproducing program to update the generation of the 
authentication key used by said contents reproducing program. 

15. (Added) The method for furnishing key data according to claim 11 wherein said first key is a ripping key for 
ripping contents from a compact disc. 

16. (Added) The method for furnishing key data according to claim 11 wherein said second key is a server con- 
necting key for downloading contents from a contents server. 

17. (Added) The method for furnishing key data according to claim 11 wherein said first key data includes a first 
master key and a first authentication key; and wherein 

said second key data includes a second master key and a second authentication key. 

18. (Added) The method for furnishing key data according to claim 1 1 wherein said first key data is furnished from 
an external storage medium. 

19. (Added) The method for furnishing key data according to claim 1 1 wherein said first key data is furnished from 
a server device. 

20. (Added) The method forfurnishing key data according to claim 11 wherein said second key data is furnished 
from a server device. 

21 . (Added) An apparatus for furnishing key data to a data processing apparatus, comprising: 

transmission means for transmitting a first key to said data processing apparatus on which a contents repro- 
ducing program has been installed; 
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said first kGy data being used for acquiring contents data stored in an external recording medium for storage 
in said data processing apparatus, said first key data also being used in authentication for transmission/re- 
ception of said contents data with a portable reproducing apparatus connected to said data processing appa- 
ratus; wherein 

if said portable reproducing apparatus and the program reproducing program from said data processing ap- 
paratus effect transmission/reception of contents data distributed from said contents server, 
said transmission means furnishes second key data different from said first key data over a network; and 
wherein 

said second key data is used for acqui-ino contents data furnished from said contents server for storage in 
said data processing apparatus, said second key dnia also being used for authentication of said data process- 
ing apparatus and said portable reproducing app^tHtus in order to effect transmission/reception of the contents 
data from said contents server. 

22. (Added) A data processing apparatus inducing a contents reproducing program for reproducing contents data, 
in which the data processing apparatus is connected lo an external storage medium and to a portable reproducing 
apparatus, and in which the data processing apparatus acquires contents data from said external storage medium 
and furnishes contents data furnished from saic external storage medium to said portable reproduction apparatus, 
wherein 

first key data furnished by said contents icpioducing piogiriin for use in storing contents data supplied from 
said external storage medium is used for authentication in acquiring contents data stored in said external 
storage medium for transmission/reception: and wherein 

when the contents reproducing program effects transmission/reception of the contents data distributed from 
a contents server, second key data different from said first key data is furnished over a network, said second 
key data furnished being used for authentication in acquiring contents dataf urnished from said contents server. 

23. (Added) The data processing apparatus according to claim 22 wherein said contents reproducing program is 
included in a comprehensive management unit processing the copyright management, said comprehensive man- 
agement unit being stored by being installed from an exlernal storage medium. 

24. (Added) The data processing apparatus according to claim 23 wherein key data for the Oth generation as said 
first key data is acquired at the same time as said comprehensive management unit is installed. 

25. (Added) The data processing apparatus according to claim 22 wherein said first key data is furnished by an 
external storage medium 

26. (Added) The data processing apparatus according to claim 22 wherein said first key data is furnished from a 
server device. 

27. (Added) The data processing apparatus according to claim 22 wherein said second key data is furnished from 
a server device. 

28. (Added) The data processing apparatus according to claim 22 wherein the key data is updated in generation 
by receivingthe ID information of a portable reproducing apparatus acquired from a key daia furnishing server and 
key data of the ith generation, and wherein said key data is transferred to the portable reproducing apparatus 
based on the ID information of said portable reproducing apparatus to update key data of said portable reproducing 
apparatus. 

29. (Added) The data processing apparatus according to claim 22 wherein if the generation of the key data of the 
(i+k)th generation of said portable reproducing apparatus is larger than the generation of the key data of the ith 
generation stored in said data processing apparatus, request of key data of the new generation is issued over a 
network to a key data furnishing server; key data of the Q"+k)th generation distributed from said key data furnishing 
server being received to update the generation of the key data. 

30. (Added) A data processing method including a contents reproducing program for reproducing contents data, 
in which the data processing method is connected to an external storage medium and to a portable reproducing 
apparatus, and is used in a data processing apparatus adapted for acquiring contents data from said external 
storage medium and for furnishing contents data furnished from said external storage medium to said portable 
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reproduction apparatus, wherein 

first key data furnished by said contents reproducing program for use in storing contents data supplied from 
said external storage medium is used for authentication in acquiring contents data stored in said external 
storage medium for transmission/reception; and wherein 

when the contents reproducing program effects transmission/reception of the contents data distributed from 
a contents server, second key data different from said first key data is furnished over a network, said second 
key data furnished being used for authentication in acquiring contents data furnished from said contents server. 

31. (Added) The data processing method according to claim 30 wherein said contents reproducing program is 
included in a comprehensive management unit processing the copyright management, said comprehensive man- 
agement unit being stored by being installed from an external storage medium. 

32. (Added) The data processing method according to claim 31 wherein key data for the 0th generation as said 
first key data is acquired at the same time as said comprehensive management unit is installed. 

33. (Added) The data processing method according to claim 30 wherein said first key data is furnished by an 
external storage medium. 

34. (Added) The data processing method according to claim 30 wherein said first key data is furnished from a 
server device. 

35. (Added) The data processing method according to claim 30 wherein said second key data is furnished from a 
server device. 

36. (Added) The data processing method according to claim 30 wherein the key data is updated in generation by 
receiving the ID information of a portable reproducing apparatus acquired from a key data furnishing server and 
key data of the ith generation, and wherein said key data is transferred to the portable reproducing apparatus 
based on the ID information of said portable reproducing apparatus to update key data of said portable reproducing 
apparatus. 

37. (Added) The data processing method according to claim 30 wherein if the generation of the key data of the 
(i+k)th generation of said portable reproducing apparatus is larger than the generation of the key data of the ith 
generation stored in said data processing apparatus, a request of key data of the new generation is issued over 
a network to the key data furnishing server; key data of the (j+k)th generation distributed from said key data fur- 
nishing server being received to update the generation of the key data. 

38. (Added) A recording medium having stored therein a program for reproducing contents data, in which the 
recording medium is connected to an external storage medium and to a portable reproducing apparatus, and in 
which the program is executed on a data processing apparatus adapted for acquiring contents data from said 
external storage medium and for furnishing contents data furnished from said external storage medium to said 
portable reproduction apparatus, wherein 

the recording medium has stored therein a program which permits said data processing apparatus to operate 
in such a manner that 

first key data furnished by said contents reproducing program for use in storing contents data supplied from 
said external storage medium is used for authentication in acquiring contents data stored in said external 
storage medium to effect transmission/reception; and that 

when the contents reproducing program effects transmission/reception of the contents data distributed from 
a contents server, second key data different from said first key data is furnished over a network, said second 
key data furnished being used for authentication in acquiring contents data furnished from said contents server. 

39. (Added) A portable reproducing apparatus connected to a data processing apparatus having a contents re- 
producing program for reproducing contents data, in which contents data furnished from said data processing 
apparatus is stored in a recording medium for reproduction, wherein 

inherent ID information and key data of plural generations are stored from the outset; 

key data of the same generation as the first key data supplied to said contents reproducing program in said 
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data processing apparatus and used for storing the contents data furnished from an external storage medium 
connected to said data processing apparatus is used to effect authentication with said data processing appa- 
ratus in acquiring contents data stored in said external storage medium connected to said data processing 
apparatus; 
s and wherein 

when said contents reproducing program effects transmission/reception of contents data distributed from the 
contents server, second key data different from said first key data is furnished to said data processing apparatus 
over a network; 

the key data of the same generation as the second key data furnished being used to effect authentication in 
10 acquiring the contents data furnished from said contents server to receive said contents data from said data 

processing apparatus. 

40. (Added) The portable reproducing apparatus according to claim 39 wherein authentication keys of plural gen- 
erations and master keys of plural generations are stored from the outset. 

15 

41 . (Added) The portable reproducing apparatus according to claim 39 wherein said first key data is a ripping key 
for ripping contents data from a compact disc and wherein the contents data can be acquired from said compact 
disc by said ripping key. 

20 42. (Added) The portable reproducing apparatus according to claim 39 wherein said second key data is a server 

connecting key for downloading contents data from a server device and wherein the contents data can be acquired 
from said server device by said server connecting key. 

43. (Added) The portable reproducing apparatus according to claim 39 wherein if, in authentication with said con- 
25 tents reproducing program, key data of a generation older than the generation used in said contents reproducing 

program is used, own key data is updated in generation up to the generation used by said contents reproducing 
program. 

44. (Added) The portable reproducing apparatus according to claim 39 wherein first to ith key data, updated in 
30 generation from the first to the ith generation, are held, and wherein 

key data of the same generation among second to ith key data furnished over a network from said contents 
reproducing program and updated in generation from the second to the ith generation, where i is an integer not 
smaller than 2, is used to effect authentication with said contents reproducing program. 

35 45. (Added) A data processing method for use in a portable reproducing apparatus connected to a data ro apparatus 

having a contents reproducing program for reproducing contenls data, said portable reproducing apparatus storing 
the contents data furnished from said data processing apparatus for reproducing the stored contents data, wherein 

inherent ID information stored in said portable reproducing apparatus from the outset and key data of plural 

Jo generations are used; 

key data of the same generation as the first key data supplied to said contents reproducing program in said 
data processing apparatus and used for storing the contents data furnished from an external storage medium 
connected to said data processing apparatus is used to effect authentication with said data processing appa- 
ratus in acquiring contents data stored in said external storage medium connected to said data processing 

45 apparatus to receive contents data stored in said external storage medium; 

and wherein 

when said contenls reproducing program effects transmission/reception of contents data distributed from the 
contents server, second key data different from said first key data is furnished to said data processing apparatus 
over a network; 

so the key data of the same generation as the second key data furnished being used to effect authentication in 

acquiring the contents data furnished from said contents server to receive said contents data from said data 
processing apparatus. 

46. Added) The portable reproducing apparatus according to claim 45 wherein said first key data is a ripping key 
55 for ripping contents data from a server device and wherein the contents data can be acquired from said server 

device by said ripping key. 

47. (Added) The portable reproducing apparatus according to claim 45 wherein said second key data is a server 
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connecting key for downloading contents data from a server device and wherein the contents data can be acquired 
from said server device by said server connecting key. 

48. (Added) The portable reproducing apparatus according to claim 45 wherein if, in authentication with said con- 
tents reproducing program, key data of a generation older than the generation used in said contents reproducing 
program is used, key data of said portable reproducing apparatus is updated in generation up to the generation 
used by said contents reproducing program. 

49. (Added) The portable reproducing apparatus according to claim 45 wherein first to ith key data, updated in 
generation from the first to the ith generation, are held, and wherein 

key data of the same generation among second to ith key data furnished over a network from said contents 
reproducing program and updated in generation from the second to the ith generation, where i is an integer 
not smaller than 2, is used to effect authentication with said contents reproducing program. 

50. (Added) A recording medium connected to a data processing apparatus having a contents reproducing program 
for reproducing contents data, in which the recording medium has stored therein a program executed by a portable 
reproducing apparatus adapted for storing and reproducing contents data furnished by said data processing ap- 
paratus, wherein 

inherent ID information stored in said portable reproducing apparatus from the outset and key data of plural 
generations are used; and wherein 

the recording medium has stored therein a program lor permitting said portable reproducing apparatus in such 
a manner that 

key data of the same generation as the first key data supplied to said contents reproducing program in said 
data processing apparatus and used for storing the contents data furnished from an external storage medium 
connected to said data processing apparatus is used to effect authentication with said data processing appa- 
ratus in acquiring contents data stored in said external storage medium connected to said data processing 
apparatus to receive conients data stored in said external storage medium; 
and wherein 

when said contents reproducing program effects transmission/reception of contents data distributed from the 
contents server, second key data different from said first key data is furnished to said data processing apparatus 
• over a network; 

the key data of the same generation as the second key data furnished being used to effect authentication in 
acquiring the contents data furnished from said contents server to receive said contents data from said data 
processing apparatus. 
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<q e , copy, q 9 > 
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Content playable from 1999/9/1 

< automaton > 

<!— This usage rule system has one Right Unit. 
Initial state is q1--> 
< Initial-right-unit state="q1 "/> 

<node state = "q1"> 

<!-lf after 1999/9/1, transfer to q2- -> 
<rule event="from" next-state="q2 n > 
< arguments > 

<integer value="time:19990901 "/> 
</arguments> 
</rule> 
</node> 

<node state s"q2 w > 
<!-- playable --> 

<rule event="play" next-state="q27> 
</node> 

< /automaton > 



FIG.16 
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Content playable until 1999/10/31 

< automaton > 

<! - - This Usage Rule System has one Right Unit. 
Initial state is q2 ■ -> 
< Initial-right-unit state="q2"/> 

<node state = "q2"> 
<!-lf after 1999/10/31, transfer to end - -> 
<rule event="to" next-state="end"> 
< arguments > 

< integer value="time:1 9991 031 "/> 
< /arguments > 
</rule> 

<!-- playable --> 

<rule evenfc="play" next-state="q2"> 
</rule> 
</node> 

< ! —Unusable state - -> 
<node state = "end"/> 



</automaton > 
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Content playable 16 times from 1999/9/1 to 1999/10/31 
< automaton) 

< !~Define counter variables for playable numbers. Initial value is 16 — > 
<define-variable name="count" initial-value="16" /) 

<!- This Usage Rule System has one Right Unit. Initial state is q1 --> 
< initial-right-unit state="q1" /> 

(node state="q1"> 
< !--From 1999/9/1 transfer to q2 -> 
<rule events" from" next-state="q2"> 
< arguments) 

(integer value="time:1 9990901 " /> 
(/arguments) 
(/rule) 
(/node) 

(node state="q2") 
( !-From 1999/10/31, transfer to end --> 
(rule event="to" next-state="end" > 
(arguments) 

(integer value="time:1 9991031" /> 
(/arguments) 
(/rule) 

(rule eventa"play" next-state="q2 n > 

( !--Playable only for "count" numbers -> 
(arguments) 

(variable name="count" /> 

< command name="load" /) 
(/arguments) 

(Mf this rule is selected, the "count" number decrements by one--) 
(action) 

(variable name=" count" /> 

(command name="load" /) 

< integer value="l" /) 

(command name="subtract" /) 

(variable name="count" /) 

(command name="store" /) 
(/action ) 
(/rule) 
(/node) 

(!-Unusable state--) 
(node state="end" /> 

(/automaton) 
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Content playable less than and/or equal to 16 times 
< automaton > 

< !-Define valuable counter for playable numbers. Initial value is 16 - > 
<define-variable name="count" initial-value="16"/> 

< !- Usage Rule System has one Right Unit. Initial state is q2 -> 

< initial-right-unit state="q1 " /> 

(node state="q2"> 
<rule event="play" next-state="q2" > 

< .'-"Count" number of times playable -> 

< arguments) 

< variable name="count" /> 

< command name="load" /> 
(/arguments) 

<!-lf this rule is selected, "count" number decrements by one-) 

< action) 

< variable name="count" /) 

< command name="load" /) 

< integer value="1" /) 

< command name="subtract" /> 
(variable name="count" /> 
(command name="store" /> 

(/action) 
(/rule) 
</node> 

(/automaton) 
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